Skip to main content
After signing up with Aviatrix Cloud Network Security Platform-as-a-Service (Aviatrix PaaS), you need to connect your cloud accounts with the Aviatrix PaaS console. The onboarding process creates the AWS roles and resources required for the Aviatrix console to monitor and manage your AWS network. You can easily onboard your AWS account in the Aviatrix console by using the provided CloudFormation template. Alternatively, you can onboard your account using your AWS key and secret. Onboard Your AWS Account By Using CloudFormation
  • Recommended for production environments
Onboard Your AWS Account By Using a Key and Secret
  • Recommended only for test environments

​
Onboard Your AWS Account By Using CloudFormation

The CloudFormation template creates the required IAM roles and policies in AWS that allow Aviatrix to manage your cloud network. These include the following:
  • aviatrix-platform-app role
  • aviatrix-role-ec2-<long-id> role
  • aviatrix-platform-app-policy policy
To view the privileges granted by the CloudFormation template, see AWS IAM Privileges for Aviatrix PaaS Onboarding. To onboard an AWS cloud account, do the following:
  1. In the Aviatrix PaaS console, go to Cloud Resources > Cloud Accounts and click +Cloud Account.
  2. Enter an Account Name and click AWS.
  3. Select AWS IAM Role and CloudFormation Script.
  4. Click Launch CloudFormation. The AWS CloudFormation quick create stack template opens.
  5. In the template, you can optionally modify the stack name and IAM role or leave them with their default settings.
    Do not modify the AviatrixPrincipalArn. This is the IAM role owned by Aviatrix and permitted to assume the aviatrix-platform-app role.
aws-onboard-cf-template
  1. Under Capabilities, click the acknowledgment and then click Create stack.
  2. On AWS CloudFormation > Stacks > Events, watch the Status column for CREATE_COMPLETE to display. Refresh the list periodically to see updates.
aws-onboard-cf
  1. When creation completes, click the Outputs tab and copy the Value for AviatrixRoleAppARN. This is the ARN in the format arn:aws:iam::<account-id>:role/aviatrix-platform-app.
aws-onboard-cf-outputs
The ARN can also be viewed at IAM > Roles by clicking the aviatrix-platform-app role.
  1. Return to the Aviatrix Onboard Cloud Account dialog box, paste the value into the field AWS Role ARN, and click Next. You will see a Discovering Cloud Resources message that changes to a success message after a minute or two.
  2. Click Close. 11. Verify that the new cloud account displays in the list on Cloud Accounts > Overview.
Next Step: Onboard your VPCs or VNets. The CloudFormation template creates the required IAM roles and policies in AWS that allow Aviatrix to manage your cloud network. Using CloudFormation is the recommended method for onboarding Aviatrix PaaS.
In the CloudFormation template, do not modify the AviatrixPrincipalArn. This is the IAM role owned by Aviatrix and permitted to assume the aviatrix-platform-app role.
When template creation starts, the AWS CloudFormation page displays to Stacks > Events. When creation completes, you need to copy the Value for AviatrixRoleAppARN from the Outputs tab and paste it in the Aviatrix Onboard Cloud Account dialog box.

​
Onboard Your AWS Account By Using a Key and Secret

Your Aviatrix ID will be used with your AWS key and secret so that Aviatrix PaaS can perform actions on your behalf.
Onboarding with a key and secret is recommended for test environments only, not for production.
Prerequisite You must already have an AWS key and secret before onboarding your AWS account. If you do not have permission to create credentials in AWS, contact your IAM administrator.
The Access Secret is only displayed when it is originally created. If you create a new key and secret for onboarding AWS, be sure to keep a copy of the secret in a secure place for future use.
To onboard your AWS account in the Aviatrix PaaS console, do the following.
  1. Go to Cloud Resources > Cloud Accounts and click +Cloud Account.
  2. Enter a unique Account Name and click AWS.
  3. Select AWS Key/Secret.
  4. Enter the Access Key ID and Access Secret for your AWS account.
  5. Enter your AWS Account Number.
  6. Click Next.
  7. Verify that the new cloud account displays in the list on Cloud Accounts > Overview.
Next Step: Onboard your VPCs or VNets

​
Troubleshoot AWS Onboarding Issues

If onboarding fails, the AWS CloudFormation stack shows failures in the Status column and the final status should display ROLLBACK_COMPLETE. Before trying to onboard your AWS account again, you must remove the CloudFormation template, two IAM roles, and a policy created in AWS by the template.
  1. In AWS console, go to CloudFormation > Stacks. screenshot of AWS cloudformation stacks page
  2. Select the failed stack. The default name is aviatrix-onboard-aws, but the name could have been modified.
  3. In the pane that displays to the right, click the Events tab. screenshot of AWS cloudformation events tab
  4. Scroll through the Events table and look for messages in the Status reason column. Examples of some root cause descriptions: screenshot of AWS cloudformation events with security group error screenshot of AWS cloudformation events with rules and policy errors
  5. Resolve the issues mentioned. If the problem is due to existing roles or policies, you will resolve those in the following steps.
  6. Click Delete to permanently remove the failed stack.
  7. Read the AWS warning and click Delete. Stack status changes to DELETE_COMPLETE after several seconds. If you refresh the Stacks pane, the stack name disappears.
  8. To remove the roles, go to AWS IAM > Access Management > Roles and select and delete the following:
  • aviatrix-platform-app
  • aviatrix-role-ec2-<long-id> screenshot of aws roles page
  1. To remove the policy, go to Access Management > Policies and then search for and delete the following:
  • aviatrix-platform-app-policy screenshot of aws roles page
You can now onboard the same account in the Aviatrix PaaS console, if you choose to do so.