Creating AWS Service Management Connector Sync user

Focus mode

Creating AWS Service Management Connector Sync user - AWS Service Management Connector

This section describes how to create the AWS Sync user and associate the appropriate IAM permission. To perform this task, you must have IAM permissions to create new users. The following steps to create a Sync user and End user are not required if you use the CloudFormation template to deploy the permissions. Refer to the AWS configurations for Connector for Jira Service Management AWS Commercial Regions and AWS GovCloud Regions.

To create AWS Service Management Connector sync user

Follow the instructions in Creating an IAM user in your AWS account to create a sync user (SMSyncUser). This user needs programmatic and AWS Management Console access to follow the Connector for Jira installation instructions.
Set permissions for your sync user (SMSyncUser). Choose Attach existing policies directly and select:

AWSServiceCatalogAdminReadOnlyAccess (AWS managed policy)

Create this policy: AWSSecurityHubPolicy. Then follow the instructions in Creating IAM Policies, and add this code in the JSON editor:


{
        "Version": "2012-10-17",
        "Statement": [
            {"Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": "<add sqs ARN here>",
            "Effect": "Allow"
            },
            {"Action": [
                 "securityhub:BatchUpdateFindings"
                 ],
                 "Resource": "*",
                 "Effect": "Allow"
      }
   ]
}

Create this policy: ConfigHealthSQSBaseline. Then follow the instructions in Creating IAM Policies, and add this code in the JSON editor:


{
        "Version": "2012-10-17",
        "Statement": [
            {"Action": [
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": "<add sqs ARN here> ",
            "Effect": "Allow"
      }
   ]
}

Create this policy: OpsCenterExecutionPolicy. Then follow the instructions in Creating IAM Policies, and add this code in the JSON editor:


{
        "Version": "2012-10-17",
        "Statement": [
            {"Effect": "Allow",
            "Action": [
                "ssm:CreateOpsItem",
                "ssm:GetOpsItem",
                "ssm:UpdateOpsItem",
                "ssm:DescribeOpsItems"
             ],
            "Resource": "*"
      }
   ]
}

Create this policy: AWSIncidentBaselinePolicy. Then follow the instructions in Creating IAM policies, and add this code in the JSON editor:


{
        "Version": "2012-10-17",
        "Statement": [
            {"Action": [
                 "ssm-incidents:ListIncidentRecords",
                 "ssm-incidents:GetIncidentRecord",
                 "ssm-incidents:UpdateRelatedItems",
                 "ssm-incidents:ListTimelineEvents",
                 "ssm-incidents:GetTimelineEvent",
                 "ssm-incidents:UpdateIncidentRecord",
                 "ssm-incidents:ListRelatedItems",
                 "ssm:ListOpsItemRelatedItems",
                 "ssm-incidents:ListRelatedItems",
                 "ssm-incidents:ListResponsePlans",
                 "ssm-incidents:StartIncident"
            ],
            "Resource": "*",
            "Effect": "Allow"
      }
   ]
}

Choose Attach existing policies directly and then select the following policies:
- AmazonSSMReadOnlyAccess (AWS managed policy)
- AWSSupportAccess (AWS managed policy)
Add a policy that allows budgets:ViewBudget on all resources (*).
Review and then choose Create User. Note the access and secret access information, and then download the .csv file containing the user credential information.

Note

To align with best practices, AWS recommends periodically rotating IAM user access keys. For more information, refer to Manage access keys for IAM users.