Skip to main content

Security

info

StackOps works exclusively with STS temporary credentials.

Identity and Access Management​

Access Role with Identity​

Access to StackOps is controlled by an IAM Role that is created during installation (ie creating the StackOps CloudFormation stack). The created role has:

  • a principal element based on the AuthorizedUserArns stack parameter; and
  • allows AuthorizedUserArns to assume the access role; and
  • allows execution of the StackOps Amazon API Gateway WebSocket.

To change who can access StackOps, update the StackOps CloudFormation stack by changing the AuthorizedUserArns parameter.

tip

AWS IAM Identity Center roles are a good choice for controlling access. Obtain your user role by:

  1. Log into AWS IAM Identity Center
  2. Select Accounts tab
  3. Decide which AWS Account you want to use for temporary credentials
  4. Open AWS Console
  5. Open CloudShell and execute aws sts get-caller-identity
  6. Copy the Arn

Log In​

Log in to StackOps by:

  1. Log into AWS IAM Identity Center
  2. Select Accounts tab
  3. Select AWS Account corresponding to your AuthorizedUserArns principal (from 3 above)
  4. Click Access Keys
  5. Copy Option 2: Add a profile to your AWS credentials file temporary credentials
  6. Opening your browser with the StackOps url (Outputs tab of the CloudFormation stack)
  7. Paste your temporary credentials

Deployment Roles​

StackOps has been designed to allow logged-in users to manage CloudFormation stacks using the roles specified in deployment files.

warning

Ensure users who can log into StackOps are able to assume all the roles contained in deployment files.

tip

Install additional StackOps instances to separate resource management responsibilities.

See Additional Installations

Authorization Explanation​

info

This section is for information purposes only.

Steps to authorize a user when they log in.

User authorization

Steps to authorize AWS CloudFormation operations.

User authorization