To provision AWS resources in Cloud Labs, you will need to grant Vocareum permission to manage relevant aspects of your AWS account. Permission is configured using AWS Identity and Access Management (IAM).

Please refer to the following AWS documentation for further context: Access to AWS accounts owned by third parties.

In your Payer account,

Vocareum will perform the following steps after your payer account is added:

For data and billing isolation purposes, we recommend creating a new, standalone AWS account for Vocareum rather than using an existing account. This new AWS account will serve as your AWS Payer.

1. Starting with an unused AWS payer account, navigate to IAM roles in the AWS console and create a new role.

2. Choose Another AWS account from the four options presented. In the Account ID field, please enter 117530877863 and verify that the number was entered correctly before proceeding. Optionally, you can check the option 'Require external ID' and enter a string in the field.

Click 'Next'.

3. We will add the permission after the role is created. Skip Add permission for now and click 'Next' at the end of the page.

4. Please enter vocareumadmin as the Role name. The role name must be entered correctly for us to assume the role. You may enter 'Admin Access for Vocareum' in the Description but this is not required.

Again we do not add the permission in this step. You may add tags if needed.

Click 'Create role' to finish creating the role.

5. After the role is created. In the Permission tab, click 'Add permissions' and select 'Select inline policy'.

Choose JSON format and cut and paste the following policy into the policy editor:

Please replace the my-billing-bucket with the name of your billing bucket name.

Click 'Next'.

Enter 'vocareumadmin-policy' as the policy name. (the name is not critical).

Then click 'Create policy' to create the policy.

6. Back to the 'vocareumadmin' role page, edit the maximum session duration from 1 hour to 12 hours.

Click 'Edit'.

Set the duration to 12 hours, then click 'Save changes'.

The 'vocareumadmin' role setup is completed.

Please proceed to the section: Enable Billing Reports.

1. Click on your account name in the navigation bar to open the drop-down menu. Then, click My Account to navigate to the account settings page.

2. Scroll down to the IAM User and Role Access to Billing Information section.

Check the box next to Activate IAM Access and then click Update.

3. In the Billing and Cost Management Console, choose 'Billing Preferences' from the left panel.

Click' Edit' to configure your billing bucket to receive the bill files.

4. In the S3 Console, enable the vocareumadmin role to retrieve bill files from you billing bucket by doing the following:

Choose your billing bucket from the S3 console, then choose the 'Permissions' tab and scroll to the Bucket policy section.

Click 'Edit' the edit the bucket policy, add the following statement to the policy

Save the changes to update the policy.

By default an AWS Organization can have up to 9 linked accounts. You will need to open a support ticket from your payer account to request an increase in linked account quota. The maximum of account quota in an organization is 5000.

Here is an sample ticket request:

1. Go to the Vocareum Control Center and select AWS from the sidebar.

2. Open the AWS Payers page.

3. Click the '+ Add payer' button to open the Add Payer form.

4. Complete the fields in the Add Payer form, including:

5. Click 'Save' at the end of the Add Payer form.

Once you have completed all the steps in this guide, please email support@vocareum.com with your AWS Payer account number so we can validate the integration.