Configure Automated Account Onboarding

1. Create an AccountAdmin programmatic access role for any currently onboarded account. Follow steps 1-4 in Enable Programmatic Access to create a role with the tag CloudNGFWAccountAdmin.
2. In each account you want to onboard, create a role to run the CloudFormation template (CFT):

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::ACCOUNT_ID:user/USERNAME"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }
   

   The role's permission policy is defined using the Create Inline Policy. For example:

   "Statement": [
           {
               "Action": [
                   "lambda:CreateFunction",
                   "iam:GetRole",
                   "lambda:AddPermission",
                   "cloudformation:ListStacks",
                   "cloudformation:CreateStack",
                   "lambda:InvokeFunction",
                   "lambda:GetFunction",
                   "iam:CreateRole",
                   "iam:DeleteRole",
                   "lambda:GetFunctionConfiguration",
                   "lambda:GetPolicy",
                   "cloudformation:DescribeStacks",
                   "cloudformation:DescribeStackEvents",
                   "cloudformation:GetTemplate",
                   "cloudformation:DeleteStack",
                   "lambda:DeleteFunction",
                   "iam:DeleteRolePolicy",
                   "iam:DetachRolePolicy",
                   "iam:AttachRolePolicy",
                   "iam:PutRolePolicy",
                   "iam:PassRole"
               ],
               "Resource": "*",
               "Effect": "Allow",
               "Sid": "VisualEditor1"
           }
       ]
   }
   

   The example of a trust relationship (above) represents a specific user in a specific account, given permission to run the CFT. For more information on how to define your own trust policy, see How to use trust policies with IAM roles.
3. Run Terraform Apply.

   After applying the changes to the CFT, the Cloud NGFW resource onboards each account:

   • The account onboarding module runs the account role setup CFT in the account.
   • The cross-account role CFT sends role ARNs to the Cloud NGFW resource.

   The account onboarding module waits for time, which may take upwards of 10 minutes to successfully onboard all accounts.

terraform {
    required_providers {
        cloudngfwaws = {
            source = "paloaltonetworks/cloudngfwaws"
        }
    }
}
provider "cloudngfwaws" {
  account_admin_arn = "arn:aws:iam::11222333344:role/fwaas_prog_onboard"
  json_config_file = "./.cloudngfwaws_creds.json"
}
module "account_onboarding1" {
    source = “github.com/PaloAltoNetworks/terraform-provider-cloudngfwaws/modules/account_onboarding"
    account_ids = ["ACCOUNT_1", "ACCOUNT_2"...., “ACCOUNT_100”]
    cft_role_name = "cft_apply_role"
}
module "account_onboarding2" {
    source = “github.com/PaloAltoNetworks/terraform-provider-cloudngfwaws/modules/account_onboarding"
    account_ids = ["ACCOUNT_101", "ACCOUNT_102"...., “ACCOUNT_200”]
    cft_role_name = "cft_apply_role"
}