@@ -340,6 +340,89 @@ The cloud_service_types items that can be specified are as follows.
340340</code >
341341</pre >
342342
343+ ---
344+ ## Secret Data Configuration
345+
346+ To use the EC2 Collector plugin, AWS authentication information is required. You can configure authentication information using the following methods.
347+
348+ ### 1. General Access Key Method (Single Account)
349+
350+ This method is used when collecting resources within the same AWS account.
351+
352+ #### Secret Data Format:
353+ ``` json
354+ {
355+ "aws_access_key_id" : " YOUR_ACCESS_KEY_ID" ,
356+ "aws_secret_access_key" : " YOUR_SECRET_ACCESS_KEY"
357+ }
358+ ```
359+
360+ #### Setup Method:
361+
362+ 1 . ** Create IAM User in AWS Console**
363+ - AWS Console → IAM → Users → Create User
364+ - Enter user name (e.g., spaceone-collector)
365+ - Select Access Key creation option
366+
367+ 2 . ** Attach Managed Policy**
368+ - Select one of the managed policies provided by AWS:
369+ - ` ReadOnlyAccess ` : Read-only permissions for all AWS services
370+ - Or use custom policy that includes only necessary services
371+
372+ 3 . ** Create Access Key**
373+ - IAM User → Security credentials → Create access key
374+ - Save Access Key ID and Secret Access Key in a secure location
375+
376+ ### 2. Cross-Account Assume Role Method (Multi-Account)
377+
378+ This method is used when collecting resources from different AWS accounts.
379+
380+ #### Secret Data Format:
381+ ``` json
382+ {
383+ "aws_access_key_id" : " SOURCE_ACCOUNT_ACCESS_KEY_ID" ,
384+ "aws_secret_access_key" : " SOURCE_ACCOUNT_SECRET_ACCESS_KEY" ,
385+ "role_arn" : " arn:aws:iam::TARGET_ACCOUNT_ID:role/ROLE_NAME" ,
386+ "external_id" : " OPTIONAL_EXTERNAL_ID"
387+ }
388+ ```
389+
390+ #### Setup Method:
391+
392+ ** Source Account (Account that runs collection) Setup:**
393+ 1 . ** Create IAM User and Set Permissions**
394+ - AWS Console → IAM → Users → Create User
395+ - Enter user name (e.g., spaceone-cross-account-collector)
396+ - Create Access Key
397+ - Attach ` ReadOnlyAccess ` policy
398+
399+ ** Target Account (Account whose resources will be collected) Setup:**
400+ 1 . ** Create Cross-Account Role**
401+ ``` json
402+ {
403+ "Version" : " 2012-10-17" ,
404+ "Statement" : [
405+ {
406+ "Effect" : " Allow" ,
407+ "Principal" : {
408+ "AWS" : " arn:aws:iam::SOURCE_ACCOUNT_ID:user/SOURCE_USER_NAME"
409+ },
410+ "Action" : " sts:AssumeRole" ,
411+ "Condition" : {
412+ "StringEquals" : {
413+ "sts:ExternalId" : " YOUR_EXTERNAL_ID"
414+ }
415+ }
416+ }
417+ ]
418+ }
419+ ```
420+
421+ 2 . ** Attach Managed Policy to Role**
422+ - Attach ` ReadOnlyAccess ` policy to the created Role
423+ - Or attach custom policy that includes only necessary services
424+ ---
425+
343426How to update plugin information using spacectl is as follows.
344427First, create a yaml file to set options.
345428
0 commit comments