Skip to content

Commit d212b9d

Browse files
marciocloudflaremarciocloudflare
authored
[MCN] Federated account access (#20551)
* added new content * refined steps * added beta
1 parent 585ff20 commit d212b9d

File tree

1 file changed

+80
-30
lines changed

1 file changed

+80
-30
lines changed

‎src/content/docs/magic-cloud-networking/get-started.mdx‎

Lines changed: 80 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,23 @@ sidebar:
66

77
---
88

9-
To get started with Magic Cloud Networking (beta) you need to give Cloudflare permission to interact with cloud providers on your behalf. You might have multiple provider accounts for the same cloud provider - for example, you might want Cloudflare to manage virtual private clouds (VPCs) belonging to two different AWS accounts.
9+
To get started with Magic Cloud Networking (beta) you need to give Cloudflare permission to interact with cloud providers on your behalf. You might have multiple provider accounts for the same cloud provider — for example, you might want Cloudflare to manage virtual private clouds (VPCs) belonging to two different AWS accounts.
1010

11-
Once Cloudflare has the credentials required to access your cloud environments, Magic Cloud Networking will automatically begin discovering your cloud resources - like routing tables and virtual private networks. Discovered resources appear in your [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog).
11+
Once Cloudflare has the credentials required to access your cloud environments, Magic Cloud Networking will automatically begin discovering your cloud resources — like routing tables and virtual private networks. Discovered resources appear in your [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog).
1212

13-
## 1. Set up cloud credentials
13+
## Set up Amazon AWS
1414

15-
Before you can connect Magic Cloud Networking to your cloud provider, you first need to create credentials with the correct permissions in your cloud provider.
15+
### 1. Create integration
1616

17-
### Amazon AWS
17+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account.
18+
2. Select **Manage Account** > **Cloud integrations**.
19+
3. Go to **Integrations** and select **Connect integration**.
20+
4. Select **AWS integration**.
21+
5. Give a descriptive name to your integration. Optionally, you can also add a description for it.
22+
6. Select **Create integration**.
23+
7. Select **Authorize access** to start the process of connecting your Cloudflare account to Amazon AWS.
24+
25+
### 2. Create IAM policy
1826

1927
1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered. Then, paste the following [JSON code](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_version.html) in the JSON tab:
2028

@@ -46,46 +54,88 @@ Before you can connect Magic Cloud Networking to your cloud provider, you first
4654
}
4755
```
4856

49-
2. Follow the [instructions on AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html) to create an IAM user up until step 4 - do not check the **Provide users access to the AWS Management Console** option.
57+
### 3. Authorize access to your AWS account
58+
59+
1. Create a [custom access policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html) in your AWS account, and take note of the name you entered.
60+
2. Create an [AWS role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html) with the following settings:
61+
1. **Trusted entity type**: Select **Custom trust policy**, and paste the custom trust policy returned by the Cloudflare dashboard.
62+
2. **Permissions**: Add the IAM policy created in step 1, along with these AWS-managed policies:
63+
- `NetworkAdministrator`
64+
- `AmazonEC2ReadOnlyAccess`
65+
- `AmazonVPCReadOnlyAccess`
66+
- `IAMReadOnlyAccess`
67+
3. **ARN**: Copy the ARN for your newly created user.
5068

51-
3. **In Give users permissions to manage their own security credentials** (step 7 of the AWS instructions) select **Attach policies directly**, and add the following policies:
52-
- `AmazonEC2ReadOnlyAccess`
53-
- `IAMReadOnlyAccess`
54-
- `NetworkAdministrator`
55-
- `<THE_NAME_OF_YOUR_CUSTOM_POLICY>` (from step 1).
69+
:::note
70+
The trust policy may take several minutes to propagate to all regions. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect.
71+
:::
5672

57-
4. [Add an Access Key](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html) to the new user. Take note of the access key as you cannot retrieve this information later. Cloudflare will ask for this value when you make an AWS Cloud Integration.
73+
3. Select **I authorize Cloudflare to access my AWS account.**
74+
4. Select **Authorize**.
5875

59-
### Microsoft Azure
76+
The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering.
6077

61-
1. [Register an application](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#register-an-application) and skip the optional **Redirect URL** step.
62-
2. [Add a client secret](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-client-secret) to the app registration. Take note of the secret value as you cannot retrieve this information later. Cloudflare will ask for this value when you make an Azure Cloud Integration.
63-
3. [Add a role assignment](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal). The purpose of this step is to give the app that you registered in step 1 permission to access your Azure Subscription.
78+
## Set up Microsoft Azure
79+
80+
### 1. Create integration
81+
82+
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account.
83+
2. Select **Manage Account** > **Cloud integrations**.
84+
3. Go to **Integrations** and select **Connect integration**.
85+
4. Select **Azure integration**.
86+
5. Give a descriptive name to your integration. Optionally, you can also add a description for it.
87+
6. Select **Create integration**.
88+
7. Select **Authorize access** to start the process of connecting your Cloudflare account to Microsoft Azure.
89+
90+
### 2. Authorize access to your Azure account
91+
92+
1. Select **Create service principal**. You will be redirected to Microsoft's login page.
93+
2. Enter your Azure credentials. If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges.
94+
3. The next screen lists Cloudflare required permissions to access your account. Select **Accept**.
95+
4. [Add a role assignment](https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal). The purpose of this step is to give the app that you registered in step 1 permission to access your Azure Subscription.
6496
1. In step 3 of the linked document, select the **Contributor** role from the **Privileged administrator roles** tab.
65-
2. In step 4 of the linked document, search for the app registration from step 1 when selecting members.
97+
2. In step 4 of the linked document, search for `mcn-provider-integrations-bot-prod` when selecting members.
98+
5. In **Provide account information**, enter the **Tenant ID** and **Subscription ID** you copied from step 4.
99+
6. In **Verify account ownership**, [add the tags displayed in the Cloudflare dashboard](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources-portal).
100+
101+
:::note
102+
The tags may take several minutes to propagate and become readable to Cloudflare. It usually takes less than four minutes, but can sometimes take longer. You may have to retry the **Authorize** button while the propagation takes effect.
103+
:::
104+
105+
7. Select **I authorize Cloudflare to access my AWS account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges.
106+
8. Select **Authorize**.
66107

67-
### Google Cloud Platform
108+
The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering.
68109

69-
1. Enable the [Compute Engine API](https://cloud.google.com/apis/docs/getting-started#enabling_apis).
70-
2. [Create](https://cloud.google.com/iam/docs/service-accounts-create) a service account.
71-
3. Grant the new service account the **Compute Network Admin** role.
72-
4. [Create](https://cloud.google.com/iam/docs/keys-create-delete) a service account key. Use the JSON key type.
110+
## Set up Google Cloud
73111

74-
## 2. Set up Cloud Integrations
112+
### 1. Create integration
75113

76114
1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com/), and select your account.
77115
2. Select **Manage Account** > **Cloud integrations**.
78-
3. Go to **Cloud integrations** and select **Add**.
79-
4. Select your cloud provider to start the cloud integration wizard.
80-
5. Enter a descriptive name, and optionally a description, for your cloud integration.
81-
6. Select **Continue**.
82-
7. Enter the credentials that you have created in [Set up cloud credentials](#1-set-up-cloud-credentials). These allow Magic Cloud Networking to access the resources in your cloud provider.
83-
8. Select **Authorize**.
116+
3. Go to **Integrations** and select **Connect integration**.
117+
4. Select **Google integration**.
118+
5. Give a descriptive name to your integration. Optionally, you can also add a description for it.
119+
6. Select **Create integration**.
120+
7. Select **Authorize access** to start the process of connecting your Cloudflare account to Google Cloud.
121+
122+
### 2. Authorize access to your Google account
123+
124+
1. Create a new [GCP service account](https://cloud.google.com/iam/docs/service-accounts-create) in your **Google account** > **GCP Console** > **IAM & Admin** > **Service Accounts**.
125+
2. Grant the new service account the **Compute Network Admin** role.
126+
3. Grant the **Service Account Token Creator** role to our bot account to allow it to impersonate this service account. Learn how to grant a specific role [in Google's documentation](https://cloud.google.com/iam/docs/manage-access-service-accounts#grant-single-role):
127+
- `[email protected]`
128+
4. In **Provide the new service account email**, enter the email account that you used to create the GCP service account.
129+
5. In your newly created account, add the [values displayed on the dash](https://www.google.com/url?q=https://cloud.google.com/resource-manager/docs/creating-managing-labels%23create-labels&sa=D&source=docs&ust=1740049107852729&usg=AOvVaw2u7AYwBxhB39ojXesn7tlm).
130+
6. Select **I authorize Cloudflare to access my GCP account.** If your account does not have administrator privileges, you may need to pass this link to an account that has administrator privileges.
131+
7. Select **Authorize**.
84132

85133
You have successfully connected your cloud provider to Magic Cloud Networking. Cloud resources found by Magic Cloud Networking are available in the [Cloud resource catalog](/magic-cloud-networking/manage-resources/#cloud-resource-catalog).
86134

135+
The first discovery of resources may not succeed in all regions, while the IAM policy is propagating. If you do not see all resources after creating your cloud integration, please try re-discovering.
136+
87137
## Next steps
88138

89139
- [Set up Magic WAN](/magic-cloud-networking/cloud-on-ramps/) as an on-ramp to your cloud.
90140
- [Manage resources](/magic-cloud-networking/manage-resources/) found by Magic Cloud Networking.
91-
- [Edit](/magic-cloud-networking/manage-resources/#edit-cloud-integrations) cloud integrations.
141+
- [Edit](/magic-cloud-networking/manage-resources/#edit-cloud-integrations) cloud integrations.

0 commit comments

Comments
 (0)