Setting up Change Manager for an organization (management account)

To set up an organization for Change Manager in the Organizations management account

1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

2. In the navigation pane, choose Quick Setup.

3. On the Change Manager card, choose Create.

4. For Delegated administrator account, enter the ID of the AWS account you want to use for managing change templates, change requests, and runbook workflows in Change Manager.

   If you have previously specified a delegated administrator account for Systems Manager, its ID is already reported in this field.

   Important

   The delegated administrator account must be the only member of the organizational unit (OU) to which it's assigned in Organizations.

   If the delegated administrator account you register is later deregistered from that role, the system removes its permissions for managing Systems Manager operations at the same time. Keep in mind that it will be necessary for you return to Quick Setup, designate a different delegated administrator account, and specify all job functions and permissions again.

   If you use Change Manager across an organization, we recommend always making changes from the delegated administrator account. Although you can make changes from other accounts in the organization, those changes won't be reported in or viewable from the delegated administrator account.

5. In the Permissions to request and make changes section, do the following.

   Note

   Each deployment configuration you create provides the permissions policy for just one job function. You can return to Quick Setup later to create more job functions when you have created change templates to use in your operations.

   To create an administrative role – For an administrator job function that has IAM permissions for all AWS actions, do the following.

   Important

   Granting users full administrative permissions should be done sparingly, and only if their roles require full Systems Manager access. For important information about security considerations for Systems Manager access, see Identity and access management for AWS Systems Manager and Security best practices for Systems Manager.

   1. For Job function, enter a name to identify this role and its permissions, such as MyAWSAdmin.

   2. For Role and permissions option, choose Administrator permissions.

   To create other job functions – To create a non-administrative role, do the following:

   1. For Job function, enter a name to identify this role and suggest its permissions. The name you choose should represent scope of the runbooks for which you will provide permissions, such as DBAdmin or S3Admin.

   2. For Role and permissions option, choose Custom permissions.

   3. In the Permissions policy editor, enter the IAM permissions, in JSON format, to grant to this job function.

   Tip

   We recommend that you use the IAM policy editor to construct your policy and then paste the policy JSON into the Permissions policy field.

   Sample policy: DynamoDB database management

   For example, you might begin with policy content that provides permissions for working with the Systems Manager documents (SSM documents) the job function needs access to. Here is a sample policy content that grants access to all the AWS managed Automation runbooks related to DynamoDB databases and two change templates that have been created in the sample AWS account 123456789012, in the US East (Ohio) Region (us-east-2).

   The policy also includes permission for the StartChangeRequestExecution operation, which is required for creating a change request in Change Calendar.

   Note

   This example isn't comprehensive. Additional permissions might be needed for working with other AWS resources, such as databases and nodes.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ssm:CreateDocument",
                   "ssm:DescribeDocument",
                   "ssm:DescribeDocumentParameters",
                   "ssm:DescribeDocumentPermission",
                   "ssm:GetDocument",
                   "ssm:ListDocumentVersions",
                   "ssm:ModifyDocumentPermission",
                   "ssm:UpdateDocument",
                   "ssm:UpdateDocumentDefaultVersion"
               ],
               "Resource": [
                   "arn:aws:ssm:region:*:document/AWS-CreateDynamoDbBackup",
                   "arn:aws:ssm:region:*:document/AWS-AWS-DeleteDynamoDbBackup",
                   "arn:aws:ssm:region:*:document/AWS-DeleteDynamoDbTableBackups",
                   "arn:aws:ssm:region:*:document/AWSConfigRemediation-DeleteDynamoDbTable",
                   "arn:aws:ssm:region:*:document/AWSConfigRemediation-EnableEncryptionOnDynamoDbTable",
                   "arn:aws:ssm:region:*:document/AWSConfigRemediation-EnablePITRForDynamoDbTable",
                   "arn:aws:ssm:region:123456789012:document/MyFirstDBChangeTemplate",
                   "arn:aws:ssm:region:123456789012:document/MySecondDBChangeTemplate"
               ]
           },
           {
               "Effect": "Allow",
               "Action": "ssm:ListDocuments",
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "ssm:StartChangeRequestExecution",
               "Resource": "arn:aws:ssm:region:123456789012:automation-definition/*:*"
           }
       ]
   }

   For more information about IAM policies, see Access management for AWS resources and Creating IAM policies in the IAM User Guide.

6. In the Targets section, choose whether to grant permissions for the job function you're creating to your entire organization or only some of your organizational units.

   If you choose Entire organization, continue to step 9.

   If you choose Custom, continue to step 8.

7. In the Target OUs section, select the check boxes of the organizational units to use with Change Manager.

8. Choose Create.