> Source: [sk122074](https://support.checkpoint.com/results/sk/sk122074) # sk122074 - Creating an AWS IAM role for CME in Security Management Server | Property | Value | |----------|-------| | Solution ID | sk122074 | | Date Created | 2017-12-28 | | Last Modified | 2023-09-26 | | Technical Level | General | | Products | Cloud Firewall | | Versions | R81 (EOS), R81.10 (EOS), R81.20 | ## Solution ### Overview Check Point Security Management Server with CME requires certain permissions in your AWS account to manage CloudGuard resources deployed in AWS and in certain cases, make changes in the environment so that the solutions will function properly. These permissions vary and depend on the solution being deployed. ### Creating an IAM role with CloudFormation Template * [Click here](https://support.checkpoint.com/results/sk/sk111013#Security%20Gateways%20Auto%20Scaling%20Group%20for%20Gateway%20Load%20Balancer%20(GWLB)) to deploy IAM role for Security Management Server that manages Gateway Load Balancer Auto Scale Group instances. * [Click here](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111013#General) to deploy IAM role for Security Management Server. The template accepts these parameters: |--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Parameter | Description | | IAM role | Select **Create with read permissions** if the Security Management Server manages [CloudGuard Auto Scaling](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112575). Select **Create with read-write permissions** if the Management Server manages [Transit Gateway Auto Scaling Group](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_AWS_Transit_Gateway/Default.htm), [Transit VPC](https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_Transit_VPC_for_AWS/html_frameset.htm) or [Gateway Load Balancer Auto Scaling Group](https://support.checkpoint.com/results/sk/sk111013#Security%20Gateways%20Auto%20Scaling%20Group%20for%20Gateway%20Load%20Balancer%20(GWLB). Specifying STS roles in the field below will add the permissions required to assume the STS role to the IAM policy attached to this IAM role. If you wish to create a IAM role to **only** assume an STS role (in the same account or another), select **Create with assume role permissions (specify an STS role ARN).** | | STS roles | Specify one or a comma separated list of roles ARNs to add permissions to assume these roles to the IAM policy attached to this IAM role. | | Trusted Account ID | If you wish to create this role so that entities in **another** AWS account will be able to use it, provide the 12 digits number that represents the ID of the trusted account. Entities in this account will be able to assume the role created by this template and receive the permissions stated in its IAM policy. See section 3 for more information. | ### Configuration of AWS STS to Delegate Access across two AWS accounts The AWS Security Token Service (STS) is a web service that enables you to request temporary, limited-privilege credentials for AWS Identity and Access Management (IAM) users. This grants entities from one AWS account, called the trusted account, privileges in a different AWS account, called the trusting account. To create a role that will be used by a Security Management Server deployed in another, trusted, account: 1. In the trusting account, launch the stack to create the AWS IAM role. 2. Provide the 12 digits number that represents the ID of the trusted account, in the **Trusted Account ID** field. 3. Select what type of permissions to grant the management server, in the **IAM role**field. 4. Click **Create**. When the stack creation successfully completes, find the **Role ARN** in the **Outputs** tab and make note of it. Then, either add the permission to assume this role to the IAM role used by the Security Management Server in the trusted account, as described in section [Connecting with Additional AWS accounts](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk130372#Connecting%20with%20Additional%20AWS%20accounts) in [sk130372](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk130372) or create a new IAM role, provide the role ARN in the **STS roles** field, and attach it to the management server. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content