Role Delegation

Connect your AWS account using cross-account IAM role delegation.

  5 minute read  

This guide walks you through connecting your AWS account to Cloud2Gether using IAM Role Delegation. This is the recommended method for production environments because it uses temporary credentials and does not require storing long-lived access keys.

How It Works

With Role Delegation, you create an IAM role in your AWS account that trusts Cloud2Gether’s AWS account. When Cloud2Gether needs to access your resources, it assumes this role using the AWS Security Token Service (STS), receiving temporary credentials that expire automatically.

┌─────────────────────┐         STS AssumeRole         ┌─────────────────────┐
│   Cloud2Gether      │ ──────────────────────────────► │   Your AWS Account  │
│   AWS Account       │                                 │                     │
│                     │ ◄────────────────────────────── │   IAM Role with     │
│                     │     Temporary Credentials       │   ReadOnlyAccess    │
└─────────────────────┘                                 └─────────────────────┘

Part 1: Create an IAM Role in AWS

You can set up the IAM role either automatically using CloudFormation or manually through the IAM console.

Automatic Setup via CloudFormation

The easiest way to create the required IAM role is using Cloud2Gether’s CloudFormation template, which automatically provisions everything you need.

Step 1: Start in Cloud2Gether

  1. Log in to Cloud2Gether
  2. Navigate to Cloud Accounts → Add Account → AWS
  3. Enter an account name
  4. Select the AWS region where the CloudFormation stack will be created
  5. Choose Automatically using CloudFormation

Step 2: Launch the CloudFormation Stack

  1. Click the Launch button — you will be redirected to the AWS Console
  2. The CloudFormation template will be pre-loaded with the required parameters
  3. Review the template details
  4. Check the acknowledgement box at the bottom (for IAM resource creation)
  5. Click Create Stack

Step 3: Wait for Stack Creation

  1. Wait for the stack status to change to CREATE_COMPLETE (usually takes 1-2 minutes)
  2. Go to the Outputs tab to find the Role ARN

Step 4: Complete in Cloud2Gether

  1. Back in Cloud2Gether, check the confirmation box: “I confirm that the Cloud2Gether IAM Role has been added to the AWS Account”
  2. Enter your AWS Account ID
  3. Enter the Role ARN from the CloudFormation Outputs tab
  4. Click Add Account

Manual Setup via IAM Console

If you prefer full control or your organization restricts CloudFormation usage, you can create the IAM role manually.

Step 1: Open the IAM Console

  1. Sign in to the AWS Management Console
  2. Navigate to IAM → Roles
  3. Click Create role

Step 2: Select Trusted Entity

  1. Select AWS account as the trusted entity type
  2. Select Another AWS account
  3. Enter Cloud2Gether’s Account ID: <CLOUD2GETHER_ACCOUNT_ID>
  4. (Optional) Check Require external ID and enter the External ID shown in the Cloud2Gether platform

Step 3: Attach Permissions

  1. In the search box, type ReadOnlyAccess
  2. Check the box next to the ReadOnlyAccess managed policy
  3. Click Next

Step 4: Name and Create the Role

  1. Enter a role name, for example: Cloud2GetherReadOnlyRole
  2. Optionally add a description: Read-only access role for Cloud2Gether platform
  3. Review the trusted entities and permissions
  4. Click Create role

Step 5: Copy the Role ARN

  1. Click on the newly created role name to open its details
  2. Copy the Role ARN (it looks like arn:aws:iam::123456789012:role/Cloud2GetherReadOnlyRole)

Part 2: Connect in Cloud2Gether

Step 1: Navigate to Cloud Accounts

  1. Log in to Cloud2Gether
  2. In the left sidebar, click Cloud Accounts
  3. Click the Add Account button
  4. Select AWS as the cloud provider

Step 2: Enter Account Details

  1. Account name: Enter a descriptive name for this account (e.g., AWS Production)
  2. Select the AWS region
  3. Choose Role Delegation as the connection method

Step 3: Enter Role Delegation Info

  1. Check the confirmation box: “I confirm that the Cloud2Gether IAM Role has been added to the AWS Account”
  2. Enter your AWS Account ID (12-digit number found in the top-right corner of the AWS Console)
  3. Enter the AWS Role ARN you copied earlier

Step 4: Add the Account

  1. Click Add Account
  2. Cloud2Gether will validate the role assumption and begin discovering your AWS resources

Trust Policy Reference

For reference, this is the trust policy that should be attached to your IAM role. If you used CloudFormation, this was configured automatically.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<CLOUD2GETHER_ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<YOUR_EXTERNAL_ID>"
        }
      }
    }
  ]
}

Replace <CLOUD2GETHER_ACCOUNT_ID> with Cloud2Gether’s AWS Account ID and <YOUR_EXTERNAL_ID> with the External ID provided in the Cloud2Gether platform.

Troubleshooting

IssueSolution
Access denied when assuming roleVerify the trust policy contains the correct Cloud2Gether Account ID and External ID.
Role not foundEnsure the Role ARN is correct and the role exists in the specified account.
CloudFormation stack failedCheck the Events tab in CloudFormation for error details. Common issues include insufficient permissions to create IAM roles.
Resources not appearingAllow a few minutes for the initial resource discovery to complete.

Next Steps

  • Explore your resources in the Resource Catalog
  • Set up additional cloud accounts for a multi-cloud view