Configure IAM Role for Momento federation

Momento delivers metrics into your AWS account by assuming an IAM role that you create. Follow this workflow to give that role permission to publish metrics to Amazon CloudWatch, and a secure trust policy that allows Momento to assume it on behalf of your Momento account.

Before you begin

You need:

• An AWS account.
• A Momento account.
• An active support plan. To request one, see Request activation of a Momento support plan.
• Access to the Momento Console, so that you can locate your Momento Account ID.

Make sure that your AWS account can create and manage IAM roles.

Creating the IAM role

Follow the usual directions for creating an IAM role in your AWS account. The AWS documentation contains what you need for that process. When you reach the permissions and trust policy, use the policies below.

Permissions

Attach the following permissions policy to the role. It allows Momento to publish metrics only to CloudWatch namespaces that begin with Momento/.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Condition": {
        "StringLike": {
          "cloudwatch:namespace": "Momento/*"
        }
      },
      "Action": [
        "cloudwatch:PutMetricData"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Trust policy

Locate your Momento Account ID, then use it in place of a-123456 in the following trust policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::168253909317:role/central-assume-role-prod"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringLike": {
          "sts:ExternalId": "a-123456/*"
        }
      }
    }
  ]
}