Step 3) Create AWS Management Account
- - Email Address to use for Root User in Management Account
- Estimated Time: 2 to 10 minutes
- Estimated Cost: none
- Perform this step on the Management Workstation.
Understanding AWS IAM best practices is important. If you haven't already reviewed
AWS documentation on IAM, please visit this link: Security best practices in IAM.
- Sign up for
an AWS account using your email address - this will become your AWS "Management"
account. Name this account "OrgMgmt" - replacing "Org" with your OrgCode.
Make a note of the email address and password used to create the account. You will
need this to login as the Account's "root" user.
Important: If you already have an AWS Account associated with your email, you will need to
create an email alias to create another AWS account. You can't use the same email address with
more than one AWS Account.
- Go to your email and use the email AWS sent you to confirm your email Address.
- Sign into your AWS
Management Console as Root user. The AWS Management Console appears.
- Create OrgMgmt IAM User and generate a OrgMgmt_credentials.csv file
- In the AWS Services section, find and select "IAM". The IAM dashboard appears.
- In left-hand navigation bar, select Users. The user list appears.
As this is a new Account, there are no IAM users.
- Click the Add user button. The Add user (step 1) page appears.
- Enter "OrgMgmt" in the User name field. Replace "Org" with your OrgCode.
- Check the Programmatic access checkbox.
- Check the AWS Management Console access checkbox.
The Console password and Require password reset options appear.
- Select the Custom password radio button. Enter a custom password.
- Uncheck the Require password reset checkbox.
- Click the Next:Permissions button.
The Add user (step 2) page appears.
- Click the Create group button. The Create group dialog appears.
- Enter "Administrators" in the Group name field
- Click the checkbox for the Policy named AdministratorAccess.
- Click the Create group button. The dialog closes.
- Click the Next: Tags button. The Add user (step 3) page appears.
- Click the Next: Review button. The Add user (step 4) page appears.
- Click the Create user button. The Add user (step 5) page appears.
- Click the Download .csv button.
- Rename the "new_user_credentials.csv" file to "OrgMgmt_credentials.csv". Replace "Org" with your OrgCode.
- Move the file to the LazyStackSettings folder.
- Click the Close button. The IAM console appears.
- Sign out of your AWS Management Account.
Install AWS CLI
- Create OrgMgmt AWS CLI Profile
- Open PowerShell terminal
- CD into the LazyStackSettings folder.
- Issue the following command: (replacing "Org" with your OrgCode)
This creates the OrgMgmt profile.
aws configure import --csv file://OrgMgmt_credentials.csv
- Issue the following command: (replacing "Org" with your OrgCode, and editing the region if necessary)
aws configure set region us-east-1 --profile OrgMgmt
- Issue the following command: (replacing "Org" with your OrgCode)":
Example Output with an OrgCode of "Az":
aws configure list --profile OrgMgmt
Name Value Type Location
---- ----- ---- --------
profile AzMgmt manual --profile
access_key ****************KZ6S shared-credentials-file
secret_key ****************8b3b shared-credentials-file
region us-east-1 config-file ~/.aws/config
- Secure your Root User Account Credentials.
You will not be using the Root User credentials often. Store them
securely where you can find them when you need them. Never share these
credentials with third-parties like vendors or consultants. Somebody with
your Root User security credentials can do anything in your account.
Note that you should not use your root credentials for deployment or operations. LazyStack
creates CLI Access Profiles on your management workstation that are used for these
- Install AWS SAM CLI - Only install Docker if you know you need it. It is not required to use LazyStack local debugging.
In this step we created a new AWS Management Account, added an IAM User "OrgMgmt" with AdministratorAccess,
Installed the AWS CLI on our workstation and configured a AWS CLI profile for the the IAM User
"OrgMgmt". Now we can perform most administrative tasks on the Management Account using the