Upgrade Cloud Account Permissions

This section describes how to upgrade a cloud account from read-only (limited) to read-write (full) permissions.

When you onboard a cloud account with read-only (limited) permissions, Aviatrix can discover and assess the resources in that account but cannot make changes to your environment.

Upgrade the read-only (limited) account to read-write (full) permissions to allow Aviatrix to perform further actions in the account, such as onboarding VPCs or VNets, enabling egress, authoring Distributed Cloud Firewall rules, and provisioning gateways.

The following table compares what Aviatrix can do in an account at each permission level:

Capability Read-only (limited) Read-write (full)

Discover networks, VPCs or VNets, and threats

Yes

Yes

Run security assessments and view insights

Yes

Yes

Onboard VPCs or VNets

No

Yes

Enable egress

No

Yes

Author Distributed Cloud Firewall rules

No

Yes

Provision gateways

No

Yes

Create Smart Groups

No

Yes

Aviatrix recommends upgrading one cloud account at a time from the Cloud Accounts list. The upgrade re-onboards the cloud account with a read-write role and preserves the account’s existing configuration.

Cloud account permission levels are not the same as user permissions. The cloud account permission level controls what Aviatrix can do in your cloud environment. User permissions control which console pages and actions a user can access.

Prerequisites

  • An AWS or Azure cloud account that is already onboarded with read-only (limited) permissions. Upgrading permissions is supported for AWS and Azure accounts.

  • Permission in the cloud account to create IAM roles and grant Aviatrix the required permissions using templates or scripts. Use the same onboarding method that you used to onboard the account:

    • For AWS, the Aviatrix CloudFormation template.

    • For Azure, the Aviatrix onboarding script (a command that you run in your cloud provider’s shell, such as Azure Cloud Shell, which creates the roles and permissions Aviatrix needs).

      If you do not have this access, contact your cloud administrator.

  • For an AWS organization, plan to upgrade every account that you onboarded in that organization.

Upgrade a Cloud Account to Read-Write Permissions

To upgrade an onboarded account from read-only to read-write permissions, do the following:

  1. In the Aviatrix PaaS console, go to Cloud Resources > Cloud Accounts. A list of onboarded cloud accounts appears.

  2. In the accounts list, find the account to upgrade. The Permission Level column identifies the accounts that currently have read-only permissions.

  3. In that account’s row, click Upgrade. The upgrade dialog appears.

  4. Launch the read-write onboarding template or script for your cloud provider and run it in the cloud account to grant Aviatrix read-write permissions.

    Refer to Onboard Your AWS Cloud Account and Onboard Your Microsoft Azure Cloud Account for more information.

    In the AWS CloudFormation template, do not modify the AviatrixPrincipalArn. This is the IAM role owned by Aviatrix and permitted to assume the aviatrix-platform-app role.

  5. Return to the Aviatrix PaaS console. The account status changes while Aviatrix re-onboards the account with the new permissions.

  6. Wait for the account status to return to ready. When the upgrade completes, the account’s permission level shows read-write (full).

  7. For an AWS organization, repeat these steps for each account that you onboarded in the organization.

You cannot downgrade an account from read-write back to read-only. To remove Aviatrix access from an account, offboard it. See Offboard Cloud Accounts.

Next Step: Onboard your VPCs or VNets.