Setting Up AWS

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Before integrating AWS with Jamf Pro, you must set up AWS first. To set up AWS, you must have an administrator Identity and Access Management (IAM) user that is part of an administrator group. For more information, see the following documentation from Amazon: Creating your first IAM admin user and group

Next, you must create an IAM policy for the user that Jamf Pro will use to integrate with AWS. The IAM user must have certain permissions configured to allow Jamf Pro to access to your AWS account. Amazon recommends that you add the IAM user to a group and attach the policy with the permissions to the group instead of the user.

For more information on how to add permissions to users and groups, see the "Adding permissions by adding the user to a group" section of the following documentation from Amazon: Changing permissions for an IAM user

  1. Create the policy:
    1. Log in to the AWS console, and navigate to the IAM section.
    2. In the IAM section, click Policies.
    3. Click Create Policy.
    4. Click the JSON tab.
    5. Delete any existing content, copy the following JSON data, and then paste it into the field.
      The following configuration is an example. You should evaluate this policy and your organizational requirements to configure the policy to your security requirements. 
      {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowFullS3JAMFBucketsOnly",
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": [
"arn:aws:s3:::jamf*"
]
},
{
"Effect": "Allow",
"Action": [
"cloudfront:CreateCloudFrontOriginAccessIdentity",
"cloudfront:CreateDistribution",
"cloudfront:CreateInvalidation",
"cloudfront:CreateStreamingDistribution",
"cloudfront:GetCloudFrontOriginAccessIdentity",
"cloudfront:GetCloudFrontOriginAccessIdentityConfig",
"cloudfront:GetDistribution",
"cloudfront:GetDistributionConfig",
"cloudfront:GetInvalidation",
"cloudfront:GetStreamingDistribution",
"cloudfront:GetStreamingDistributionConfig",
"cloudfront:ListCloudFrontOriginAccessIdentities",
"cloudfront:ListDistributions",
"cloudfront:ListInvalidations",
"cloudfront:ListStreamingDistributions",
"cloudfront:UpdateCloudFrontOriginAccessIdentity",
"cloudfront:UpdateDistribution",
"cloudfront:UpdateStreamingDistribution"
],
"Resource": [
"*"
]
}
]
}
    6. Click Next.
    7. Enter a name for the new policy and add an optional description.
    8. (Optional) Add IAM tags.
    9. Click Create Policy.
  2. Create a new IAM user and attach the new policy:
    1. In the IAM section, click Users, and then click Create user.
    2. Enter a name for the new user.
    3. Click Next.
    4. Click Attach existing policies directly, and search for the policy that you previously created.
    5. Click Next.
    6. Add IAM tags.
    7. Review the data and click Create user.
    8. Depending on your environment, create and download the access key and the secret access key.