Overview

This article explains how to configure the Credential Store with the old plan for AWS WAF v2 and AWS WAF Classic.

There are three methods of configuration.

• Create an IAM Role and register it (Create a new IAM role with CloudFormation)
• Use an existing IAM Role (Create an IAM role on the AWS management console first and then register the information)
• Use an existing IAM User (Create an IAM user on the AWS management console first and register the keys)

All necessary permissions ( AWSWAFFullAccess , AmazonS3ReadOnlyAccess , and CloudWatchReadOnlyAccess) are automatically applied to the IAM role with the [Create an IAM Role and register it (Create a new IAM role with CloudFormation)] method because the IAM role is created by CloudFormation.

CloudWatchReadOnlyAccess is not required for the old plan users, so you can delete the CloudWatchReadOnlyAccess permission after the IAM role has been created.

For more details about the permissions, please refer to Required permissions for AWS WAF Classic/AWS WAF v2 (old plan).

Notes

• The following notes apply to the [Create an IAM Role and register it (Create a new IAM role with CloudFormation)] method out of the three methods.
  • This method automatically applies all necessary permissions for the new plan. When CloudFormation is used to create an IAM role, the old plan users need to adjust the permissions separately.
  • CloudFormation is executed in the ap-northeast-1 (Tokyo) region.
• The method to use the IAM role (AssumeRole) is recommended.
• [Use an existing IAM User (Create an IAM user on AWS management console first and register the keys)] method is not recommended because it requires access key and secret key registration. The [Create] button is not disabled, so please click the [Create] button and proceed if you wish to use this method.

Procedure

Create an IAM Role and register it (Create a new IAM role with CloudFormation)

1. Sign in to the WafCharm console.
2. Click [Credential] from the left menu.
3. Click the [Create] button below the [Create an IAM Role and register it].
4. Read the information available on [Introduction] to check your AWS account and click [Next].

   If your AWS account does not have permission to create a CloudFormation stack and IAM role, the process will fail in the following steps.

   The introduction contains information about read permission on CloudWatch Metrics (CloudWatchReadOnlyAccess), but this permission will be deleted in the following steps because it is not required for the old plan users.

   

5. Enter the AWS Account ID to use and the IAM Role Name to create.

   CloudFormation will use the specified name to create an IAM role. Please choose a name that is easy to recognize.

   

6. Click the [Create a template] button.
7. Click the URL below the message [Copy and access the URL below to complete configuring the IAM Role in the AWS management console.].

   URL is a link and will take you to the CloudFormation page on your AWS management console.

8. Check the checkbox below on the AWS management console.

   I acknowledge that AWS CloudFormation might create IAM resources with custom names.

9. Click [Create stack].
10. Wait for the completion of stack creation.
11. When the creation is completed, check that the IAM role has been successfully created.
12. Open the IAM role page, check [CloudWatchReadOnlyAccess], and click the [Remove] button to remove the permission.

    As stated above, this permission is not required in the old plan.

13. Go back to the WafCharm Console and click on the [Validate] button.
14. If you see a message that says "Validated," go to the next step.

    

15. Check the Credential Store name.

    The IAM role name will be entered in the Credential Store name. If you want to keep the same name, go to the next step. If you want to change the name of the Credential Store, please adjust the name shown on the page.

16. Click [Create].

The Credential Store creation is complete if a message that says "Your credential information has been created." is shown on the page. Click on the [Back to list of Credentials] button to see the registered Credential Stores.

Use an existing IAM Role (Create an IAM role on the AWS management console first and then register the information)

1. Sign in to the AWS management console.
2. Open the IAM dashboard.
3. Click [Roles] from the left menu.
4. To create an IAM role, click the [Create role] button at the top right corner of the Roles page.
5. Select AWS Account under [Select trusted entity].

   Choose [This account (account ID)] for [An AWS Account]. Leave the [Options] as is.

   When the trusted policy is updated on the created IAM role in the following steps, the trusted account will be changed to the intended AWS account instead of your account.

6. Add necessary permissions under the [Permissions policies].

   AWSWAFFullAccess and AmazonS3ReadOnlyAccess

   The introduction on the WafCharm Console contains information about read permission on CloudWatch Metrics (CloudWatchReadOnlyAccess), but this permission is not required for the old plan users.

7. On the next page, enter the role name, check the settings, and click the [Create role] button.

   The trust policy will be updated later. At this point, the trust policy shown under [Step 1: Select trusted entities] can contain your AWS account ID.

8. Go back to the Roles page and open the IAM role you have just created. The trust policy will be updated later, so please keep this page open.
9. Sign in to the WafCharm console.
10. Click [Credential] from the left menu.
11. Click the [Create] button below the [Use existing IAM Role].
12. Click [Generate the trust policy for your IAM role].

    

13. Click the [Copy] button to copy the trust policy.

    

14. Go back to the AWS management console and click the [Trust relationships] tab on your IAM role.
15. Click the [Edit trust policy] button.
16. Paste the trust policy copied from the WafCharm Console under the [Edit trust policy] section.
17. Click the [Update policy] button.
18. Copy the IAM role's ARN.
19. Go back to the WafCharm Console and paste the ARN in the field shown under [Enter the ARN of your IAM role and click the Validate button.].
20. Click the [Validate] button.
21. If you see a message that says "Validated," go to the next step.

    

22. Enter the Credential Store name on the Create page.
23. Click [Create].

The Credential Store creation is complete if a message that says "Your credential information has been created." is shown on the page. Click on the [Back to list of Credentials] button to see the registered Credential Stores.

Use an existing IAM User (Create an IAM user on the AWS management console first and register the keys)

1. Sign in to the AWS management console.
2. Open the IAM dashboard.
3. Click [Users] from the left menu.
4. Click the [Add users] button on the top right corner to create an IAM user.
5. Enter [User name].
6. Click [Create group].

   If a group already exists, select one from [User groups] and proceed to step 10.

7. Enter [User group name].
8. Add necessary permissions under the [Permissions policies].

   AWSWAFFullAccess and AmazonS3ReadOnlyAccess

9. Click [Create user group] and select the created user group.
10. Click [Next].
11. Click [Create user].
12. Click the name of the created user.
13. Click the [Security credentials] tab.
14. Create an access key from [Access keys].
15. Copy the access key and secret key.

    The access key and secret key will be used in the following steps.

    Download the CSV file from [Download .csv file] if necessary.

16. Sign in to the WafCharm console.
17. Click [Credential] from the left menu.
18. Click the [Create] button below the [Use existing IAM User].

    The option is grayed out, but it is clickable.

19. Paste each key in the [Access Key ID] field and the [Secret Access Key] field under the [Verify IAM User Credential] section.

    

20. Click the [Validate] button and check that the "Validated" message is shown.

    You cannot register the same access key/secret key to the same WafCharm account. If the registered access key/secret key already exists within the WafCharm account, you will see an error message. If you want to use the same access key/secret key in multiple resources in the WafCharm Console, please use the same Credential Store.

    

21. Enter the Credential Store name on the Create page.
22. Click [Create].

The Credential Store creation is complete if a message that says "Your credential information has been created." is shown on the page. Click on the [Back to list of Credentials] button to see the registered Credential Stores.