Setup Methods

This guide covers the three methods for creating an IAM role to connect your AWS account: Manual, CloudFormation, and Terraform.

Wizard Overview

The connection wizard has 5 steps:

Step 1: Choose Connection Scope

Select how this AWS connection will be used:

Organization-wide (Recommended)

• Available to all sites in your organization
• Best when using one AWS account for all deployments
• Simplifies management with a single connection

Site-specific

Site-specific connections will allow you to connect different AWS accounts to individual sites for isolation or compliance requirements.

Step 2: Choose Setup Method

Select your preferred method for creating the IAM role:

Step 3: Route53 Option

Choose whether you plan to use AWS Route53 for DNS management:

Yes, use Route53

Select this if you want Orkestia to:

• Automatically create DNS records for your domains
• Manage SSL certificate validation records
• Handle subdomain configuration

The IAM role will include additional Route53 permissions.

No, use external DNS

Select this if you:

• Use Cloudflare, GoDaddy, or another DNS provider
• Will manually configure DNS records
• Don't need automatic DNS management

Step 4: Setup Instructions

Follow the instructions for your chosen setup method below.

Example: lt_42_a1b2c3d4e5f6789012345678901234567

856022192189

{
"Version": "2012-10-17",
"Statement": [
  {
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::856022192189:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "YOUR_EXTERNAL_ID"
      }
    }
  }
]
}

{
"Version": "2012-10-17",
"Statement": [
  {
    "Sid": "S3BucketManagement",
    "Effect": "Allow",
    "Action": [
      "s3:CreateBucket",
      "s3:DeleteBucket",
      "s3:ListBucket",
      "s3:GetBucketLocation",
      "s3:GetBucketPolicy",
      "s3:PutBucketPolicy",
      "s3:DeleteBucketPolicy",
      "s3:GetBucketWebsite",
      "s3:PutBucketWebsite",
      "s3:DeleteBucketWebsite",
      "s3:PutBucketPublicAccessBlock",
      "s3:GetBucketPublicAccessBlock"
    ],
    "Resource": "arn:aws:s3:::ltinteg-*"
  },
  {
    "Sid": "S3ObjectManagement",
    "Effect": "Allow",
    "Action": [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject",
      "s3:ListBucket"
    ],
    "Resource": [
      "arn:aws:s3:::ltinteg-*",
      "arn:aws:s3:::ltinteg-*/*"
    ]
  },
  {
    "Sid": "CloudFrontManagement",
    "Effect": "Allow",
    "Action": [
      "cloudfront:CreateDistribution",
      "cloudfront:GetDistribution",
      "cloudfront:UpdateDistribution",
      "cloudfront:DeleteDistribution",
      "cloudfront:ListDistributions",
      "cloudfront:CreateInvalidation",
      "cloudfront:GetInvalidation",
      "cloudfront:ListInvalidations"
    ],
    "Resource": "*"
  }
]
}

Example: arn:aws:iam::123456789012:role/OrkestiaRole

# The CloudFormation template is provided by your Orkestia contact.
# (The Manual method above is fully self-contained and needs no download.)

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name ltinteg-role \
  --parameter-overrides \
    ExternalId=YOUR_EXTERNAL_ID \
    OrkestiaAccountId=856022192189 \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name ltinteg-role \
  --parameter-overrides \
    ExternalId=YOUR_EXTERNAL_ID \
    OrkestiaAccountId=856022192189 \
    UseRoute53=true \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation describe-stacks \
  --stack-name ltinteg-role \
  --query "Stacks[0].Outputs[?OutputKey=='RoleArn'].OutputValue" \
  --output text

# The Terraform module is provided by your Orkestia contact.
# (The Manual method above is fully self-contained and needs no download.)

external_id         = "YOUR_EXTERNAL_ID"
ltinteg_account_id  = "856022192189"

external_id         = "YOUR_EXTERNAL_ID"
ltinteg_account_id  = "856022192189"
use_route53         = true

terraform init
terraform plan
terraform apply

terraform output cross_account_role_arn

::

Step 5: Enter Connection Details

After creating the IAM role using any method:

5.1 Enter Connection Name

Give your connection a descriptive name:

• Production Account
• Staging Environment
• US-East Region

5.2 Enter Role ARN

Paste the IAM Role ARN you obtained:

arn:aws:iam::123456789012:role/OrkestiaRole

The wizard validates the ARN format in real-time:

• Green checkmark — Valid ARN format
• Red X — Invalid format, check for typos

5.3 Connect

Click Connect AWS to create the connection.

Orkestia will:

1. Attempt to assume the role
2. Validate required permissions
3. Check for security issues

Next Steps