CloudShare enables you to run your environments (either an entire environment or selected VMs) on the AWS public cloud infrastructure. You have the flexibility to choose between running on AWS using a CloudShare AWS account, or running on AWS using your organization’s AWS account (i.e., “bring your own account”). 

When you choose to bring your own account, CloudShare spins out and orchestrates your training and POC environments on the AWS infrastructure managed by your organization’s AWS account.

The main steps for integrating AWS infrastructure with CloudShare are:

1. Creating AWS Accounts. This step is required when you are using your organization’s AWS account. When you use a CloudShare AWS account, it is not needed.
2. Setting Up Your Environment Images. This step grants CloudShare the required access to your AMIs. CloudShare fully supports the addition of public AMIs, Custom AMIs and Marketplace AMIs.
3. Setting the Access Role for Your End Users. This step determines which AWS Roles are available for assignment to your end users.

To provide completely isolated environments for each of your end users, CloudShare uses multiple accounts in AWS. This results in a unique environment for each end user via a separate AWS account, enabling each end user access to a true ephemeral environment, as well as the ability to access the AWS Admin Console without any concern over impacting other environments or end users.

Step 1: Increase the number of accounts in your AWS organization.

By default, AWS allows four (4) accounts as the maximum number for an organization. To enable more accounts for use by multiple end users, you should increase the maximum number of accounts in your organization to reflect the total projected number of end users that will participate simultaneously in your training and POC experiences.

To increase the maximum number of accounts for an organization, you should open a ticket to AWS support from your organization root account.

Step 2: Create your accounts.

You can choose to either enable CloudShare to create the accounts on your organization’s behalf automatically, or to create the accounts by yourself:

Enabling CloudShare to create accounts. When you choose this path, you will need to grant CloudShare permission to create accounts under your AWS organization:

1. Under your main AWS account, go to the IAM service and create a new role.
2. Choose AWS account as the Trusted entity type.
3. Select the Another AWS account radio button. The account ID will be provided by CloudShare Support.
4. On the next page, create a new policy named CreateAccountPolicy.
5. Use the following JSON for the permissions:
   

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "VisualEditor0", 
         "Effect": "Allow", 
         "Action": [
            "organizations:CreateAccount", 
            "organizations:DescribeCreateAccountStatus"
         ],
         "Resource": "*"
       },
       {
         "Sid": "VisualEditor1", 
         "Effect": "Allow", "Action": 
         "sts:AssumeRole", 
         "Resource":
   "arn:aws:iam::*:role/OrganizationAccountAccessRole"
            }
       ]
   }

    

6. Attach the new policy you created.
7. Name the new role CreateAccountRole.

Each AWS account is created with an owner (identified by a unique email address). CloudShare needs this information for administration.

The following is an example of a good email convention:

cloudshare-CUSTOMER_NAME-###@domain.com

CloudShare will automatically replace the ### with a running number (001, 002, etc.) when the associated account is used.

Creating the accounts by yourself – If you choose this path, you are responsible for creating the AWS accounts that will be used by CloudShare to manage your environments for each participant.

After you have created the AWS accounts, you will need to provide CloudShare with a list of the relevant accounts that you’ve created.

Step 3: Grant CloudShare access to manage accounts.

This step will add CloudShare's master account, which will be provided by CloudShare support, as a trusted entity for your new accounts.

For each of the newly created accounts, go to the IAM service.
Under Roles, go into the OrganizationAccountAccessRole role.

Click on the "Trust relationships" tab.
Then click on the "Edit Trust Policy" button.

Add our master account by either manually editing the policy and adding it under the Principal section:

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Effect": "Allow",
   "Principal": {
    "AWS": [
     "arn:aws:iam::<CloudShare's Master Account ID>:root",
     "arn:aws:iam::<Your Master Account ID>:root"
    ]
   },
   "Action": "sts:AssumeRole"
  }
 ]
}

Or by clicking on this Add button:

Choose "AWS account and root user" as the Principal type.
For the ARN, replace the {Account} placeholder with our master account ID

The OrganizationAccountAccessRole role is created by AWS automatically on all accounts that belong to an organization.

With this role CloudShare will be able to provision the AWS resources on the account.