Skip to content

Commit d05f8f8

Browse files
add: 수집 설정 가이드 READEME 추가
Signed-off-by: jinyoungmoonDEV <[email protected]>
1 parent 63a8930 commit d05f8f8

File tree

1 file changed

+83
-0
lines changed

1 file changed

+83
-0
lines changed

README.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,89 @@ The cloud_service_types items that can be specified are as follows.
340340
</code>
341341
</pre>
342342

343+
---
344+
## Secret Data Configuration
345+
346+
To use the EC2 Collector plugin, AWS authentication information is required. You can configure authentication information using the following methods.
347+
348+
### 1. General Access Key Method (Single Account)
349+
350+
This method is used when collecting resources within the same AWS account.
351+
352+
#### Secret Data Format:
353+
```json
354+
{
355+
"aws_access_key_id": "YOUR_ACCESS_KEY_ID",
356+
"aws_secret_access_key": "YOUR_SECRET_ACCESS_KEY"
357+
}
358+
```
359+
360+
#### Setup Method:
361+
362+
1. **Create IAM User in AWS Console**
363+
- AWS Console → IAM → Users → Create User
364+
- Enter user name (e.g., spaceone-collector)
365+
- Select Access Key creation option
366+
367+
2. **Attach Managed Policy**
368+
- Select one of the managed policies provided by AWS:
369+
- `ReadOnlyAccess`: Read-only permissions for all AWS services
370+
- Or use custom policy that includes only necessary services
371+
372+
3. **Create Access Key**
373+
- IAM User → Security credentials → Create access key
374+
- Save Access Key ID and Secret Access Key in a secure location
375+
376+
### 2. Cross-Account Assume Role Method (Multi-Account)
377+
378+
This method is used when collecting resources from different AWS accounts.
379+
380+
#### Secret Data Format:
381+
```json
382+
{
383+
"aws_access_key_id": "SOURCE_ACCOUNT_ACCESS_KEY_ID",
384+
"aws_secret_access_key": "SOURCE_ACCOUNT_SECRET_ACCESS_KEY",
385+
"role_arn": "arn:aws:iam::TARGET_ACCOUNT_ID:role/ROLE_NAME",
386+
"external_id": "OPTIONAL_EXTERNAL_ID"
387+
}
388+
```
389+
390+
#### Setup Method:
391+
392+
**Source Account (Account that runs collection) Setup:**
393+
1. **Create IAM User and Set Permissions**
394+
- AWS Console → IAM → Users → Create User
395+
- Enter user name (e.g., spaceone-cross-account-collector)
396+
- Create Access Key
397+
- Attach `ReadOnlyAccess` policy
398+
399+
**Target Account (Account whose resources will be collected) Setup:**
400+
1. **Create Cross-Account Role**
401+
```json
402+
{
403+
"Version": "2012-10-17",
404+
"Statement": [
405+
{
406+
"Effect": "Allow",
407+
"Principal": {
408+
"AWS": "arn:aws:iam::SOURCE_ACCOUNT_ID:user/SOURCE_USER_NAME"
409+
},
410+
"Action": "sts:AssumeRole",
411+
"Condition": {
412+
"StringEquals": {
413+
"sts:ExternalId": "YOUR_EXTERNAL_ID"
414+
}
415+
}
416+
}
417+
]
418+
}
419+
```
420+
421+
2. **Attach Managed Policy to Role**
422+
- Attach `ReadOnlyAccess` policy to the created Role
423+
- Or attach custom policy that includes only necessary services
424+
---
425+
343426
How to update plugin information using spacectl is as follows.
344427
First, create a yaml file to set options.
345428

0 commit comments

Comments
 (0)