# Cross-Account Access via Console

{% hint style="info" %}
There are multiple ways to deploy AWS roles to provide Dropzone visibility into your environment. See [the AWS documentation](/integrations/data/aws_data.md) for more info.
{% endhint %}

The following steps walk you through creating a role and granting it to the Dropzone-provided role in the AWS console. This also has the information you'd need to create your own Infrastructure-as-Code configuration if you choose.

### Find the Dropzone IAM Role Information

* Navigate to your Dropzone AI tenant home page e.g. https\://*mycompany*.dropzone.app
* In the bottom left hand corner, navigate to Settings > Integrations

<figure><img src="/files/zN02u3HObDaemUY8E1kD" alt=""><figcaption><p>Integrations Dropdown</p></figcaption></figure>

* Click "Available"

<figure><img src="/files/brI7n2Ux40Tk0jTwBCVh" alt=""><figcaption><p>Click Available</p></figcaption></figure>

* In the Search bar, search AWS, then click "Configure"

<figure><img src="/files/c1LAMHwJP8ERrj4i4vBq" alt=""><figcaption><p>The AWS Tile</p></figcaption></figure>

* Under the "Connection" section, record the `ARN` and `EXTERNAL ID` values, for use later in the AWS CloudFormation UI

<figure><img src="/files/VS7fvETTaeuuyJjHd8bB" alt="" width="296"><figcaption><p>The AWS Connection Information</p></figcaption></figure>

### Create the Role

Next you'll create a role in the AWS account you want monitored and available.

You'll need the following information:

| Value                         | Used In                           | Source                                                                    |
| ----------------------------- | --------------------------------- | ------------------------------------------------------------------------- |
| Dropzone-provided ARN         | AWS Role Custom Trust Policy JSON | `ARN` value from the AWS Data Source "Connection" section                 |
| Dropzone-provided External ID | AWS Role Custom Trust Policy JSON | `External ID` value from the AWS Data Source "Connection" section         |
| AWS Account ID                | Custom Permissions Policy JSON    | Find this in the user/role dropdown in the upper right of the AWS console |

* Log in to the AWS Management Console for the account where you want to create the role
* Open the Identity Access and Management (IAM) dashboard

<figure><img src="/files/yfaZ0ANCaRbvtsE866me" alt=""><figcaption><p>IAM</p></figcaption></figure>

* From the left navigation, select "Access Management" > Roles
* Click "Create Role"

<figure><img src="/files/ET6xbbywEpOt7f6lxwg8" alt=""><figcaption><p>Create Role</p></figcaption></figure>

* Click "Custom Trust Policy"

<figure><img src="/files/yfRkpcM6e0WHzSEDxuRR" alt=""><figcaption><p>Custom Trust Policy Selection</p></figcaption></figure>

* In the text field below, paste the following policy, replacing the `<Dropzone-provided User ARN>` and `<Dropzone-provided External ID>` strings with the values from the Dropzone UI you recorded earlier:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<Dropzone-provided User ARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<Dropzone-provided External ID>"
                }
            }
        }
    ]
}
```

* In the bottom right, click "Next"
* You'll now be on the "Add Permissions" page where you can add AWS pre-built policies

<figure><img src="/files/ZHmxDUdjfW6Erql2vRzD" alt=""><figcaption><p>Add Permissions page</p></figcaption></figure>

* You may add policies in one of two ways. You may add the `ReadOnlyAccess` policy, which will allow Dropzone to have all policies needed even in the future, or add the following policies one-by-one as needed:

| Service Integration | Policy                                     | Required |
| ------------------- | ------------------------------------------ | -------- |
| CloudTrail          | `AWSCloudTrail_ReadOnlyAccess`†            | Required |
| EC2                 | `AmazonEC2ReadOnlyAccess`                  | Required |
| EKS                 | `eks:ListClusters`, `eks:DescribeCluster`‡ | Optional |
| GuardDuty           | `AmazonGuardDutyReadOnlyAccess`            | Optional |
| IAM                 | `IAMReadOnlyAccess`                        | Optional |
| Route53             | `AmazonRoute53ReadOnlyAccess`              | Optional |
| S3                  | `AmazonS3ReadOnlyAccess`                   | Optional |
| S3 (Outposts)       | `AmazonS3OutpostsReadOnlyAccess`           | Optional |
| Systems Manager     | `AmazonSSMReadOnlyAccess`                  | Optional |

{% hint style="info" %}
CloudTrail Permissions: Required (Minimum): `AWSCloudTrail_ReadOnlyAccess` managed policy. This provides the minimum permissions needed for CloudTrail integration. The integration will use the `lookup_events` API for querying CloudTrail logs. Optional (Recommended): `cloudtrail:StartQuery` permission on event datastores. This enables CloudTrail Lake SQL queries, which provide more powerful querying capabilities. If this permission is not available, the integration will automatically fall back to the `lookup_events` API. To add this permission, attach a custom policy with:

```json
{
  "Effect": "Allow",
  "Action": "cloudtrail:StartQuery",
  "Resource": "arn:aws:cloudtrail:*:*:eventdatastore/*"
}
```

{% endhint %}

{% hint style="info" %}
EKS Note: AWS does not provide a managed EKS policy. Create a custom policy with `eks:ListClusters`, `eks:DescribeCluster`, and other read-only EKS permissions (`eks:Describe*`, `eks:List*`) as needed.
{% endhint %}

* You may add permissions in one of two ways. You may add the `ReadOnlyAccess` permission policy, which will allow Dropzone to have all permissions needed even in the future, or add the following policies one-by-one

| Permissions Policy               |
| -------------------------------- |
| `AWSCloudTrail_ReadOnlyAccess`   |
| `AmazonEC2ReadOnlyAccess`        |
| `AmazonGuardDutyReadOnlyAccess`  |
| `AmazonRoute53ReadOnlyAccess`    |
| `AmazonS3OutpostsReadOnlyAccess` |
| `AmazonS3ReadOnlyAccess`         |
| `AmazonSSMReadOnlyAccess`        |
| `IAMReadOnlyAccess`              |

* Click "Next" when done adding permissions
* Give the new role the name "Dropzone\_AI"

<figure><img src="/files/YFkjMJLExLpojbirPXJk" alt=""><figcaption><p>Role Name</p></figcaption></figure>

* In the bottom right, click "Create Role"

<figure><img src="/files/ET6xbbywEpOt7f6lxwg8" alt=""><figcaption><p>Create Role</p></figcaption></figure>

## Add a custom permission policy

* Navigate to "Identity and Access Management (IAM)" > "Access Management" > "Roles"
* Search for the new role and click on it

<figure><img src="/files/KniWYbKwhS4MevEZ67ng" alt=""><figcaption><p>Find the Role</p></figcaption></figure>

* In the middle of the page, you'll see "Permissions Policies"

<figure><img src="/files/nUO7GZM4BHJ0I5u2xbxv" alt=""><figcaption><p>Permissions Policies</p></figcaption></figure>

* Click "Add Permission"
* Select "Create Inline Policy"

<figure><img src="/files/v428C8z9WKh16GkiyTnt" alt=""><figcaption><p>Create Inline Policy Option</p></figcaption></figure>

* In the text field, paste the following policy, replacing the `<your_accountnumber>` strings with this AWS account ID:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudTrailStartQuery",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey",
                "cloudtrail:StartQuery"
            ],
            "Resource": [
                "arn:aws:kms:*:<your_accountnumber>:key/*",
                "arn:aws:cloudtrail:*:<your_accountnumber>:eventdatastore/*"
            ]
        },
        {
		 "Sid": "EKSReadOnly",
		 "Effect": "Allow",
		 "Action": [
		     "eks:Describe*",
		     "eks:List*"
		 ],
		 "Resource": "*"
	  }

    ]
}
```

<figure><img src="/files/XvGi5l1VAwNO7J2Txgcx" alt=""><figcaption><p>Custom Permissions JSON</p></figcaption></figure>

* Click "Next"
* Give the new permission the name "Dropzone\_AI\_Additional"
* Click "Create Policy"

You should be returned to the `Dropzone_AI` role page and see the policies you've added, including the custom policy.

* Record the ARN for this role for use later in the Dropzone UI when configuring the Dropzone Data and Alert Sources, where it will be referred to as the "Role ARN"

<figure><img src="/files/qobQa6BPQcbqz1G5i1xL" alt=""><figcaption><p>AWS Role Page</p></figcaption></figure>

## Repeat For Additional AWS Accounts

Repeat the steps taken in the "Create the Role" section for all other AWS accounts you want visible to Dropzone.

{% hint style="info" %}
Make sure you're keeping a list of all the role ARNs you create along the way - you'll need them later.
{% endhint %}

Once done, you may move onto configuring the Dropzone Data and Alert Sources described in [the AWS documentation](/integrations/data/aws_data.md)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.dropzone.ai/integrations/data/aws_data/aws-console_data.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.