This section guides you through management of AWS IAM roles needed for operating Viz Now with your AWS account.

Secure, reliable operations are ensured by first clarifying permissions and adopting these best practices.

Overview

Viz Now requires two IAM roles:

These roles are assumed using AWS STS (Security Token Service), and their ARNs are stored securely in Viz Now.

Prerequisites

• An active AWS account.

• IAM Administrator access to AWS.

• Administrator access to the Viz Now platform.

Update Existing IAM Roles

If your AWS account already has Viz Now IAM roles defined, follow these guidelines to update them.

IAM Roles

You will update both the Deploy and Management IAM roles and their associated inline policies.

To update an IAM role in Viz Now

This procedure assumes that your Viz Now user details are already setup in AWS. See the Note above.

1. Log in to your AWS Management Console with IAM Administrator permissions.
   Keep this tab active in your browser.

2. Log in to the Viz Now and navigate to the panel Organization > Infrastructure tab > Manage IAM Roles.
   You’ll see a screen like the one below, where you can define the IAM Role ARNs for the Deploy and Control Plane functionality.

   

   Keep this tab active in your browser.
   
   Deploy role

3. Update the inline policy:

   1. Switch to the AWS console IAM > Roles and from the Permissions tab, you can search for required inline policy.
      This is the same as in the Viz Now UI:

      

      Click it to open.

   2. Go back to Viz Now and in the Manage IAM Roles panel, next to Deploy Role, click the Question mark icon .

      

      and then Copy inline policy.

      

      (This saves the policy details to the clipboard).

   3. Switch back to the AWS Console Policy editor and click the JSON button.

      

   4. In the Policy editor, paste-in the inline policy from the clipboard.

      

   5. Click Next and then click Save changes.

   6. A confirmation message is displayed.

      

      
      Management Role
      You now repeat the same steps for the Management role.

4. In Viz Now, next to the input field Management Role, click the Question mark icon .

   

   1. From the pop-up, click Copy inline policy.

      

   2. In the AWS Console, search for the required manage role, in this example, viz-now-manage, and click on it to display a Summary page.

      

   3. Select the Permissions tab and then its contained policy.
      The Policy editor page opens:

      

   4. Paste-in the inline policy that you copied to your clipboard, to update the JSON code.
      For an example, see the code below.

   5. Click Save changes.

5. Validate IAM Role in Viz Now:

   1. Click Cancel.

   2. In Viz Now Manage IAM Roles panel, click Validate Roles.

      

   3. A confirmation message is displayed.

      

Permissions Explained

Deploy Role (viz-now-deploy-infra)

The Deploy role grants broad permissions to allow Spacelift to deploy infrastructure using Terraform. All permissions apply to all resources ("Resource": "*").

Manage Role (viz-now-manage)

The Manage role enables Viz Now to perform operational tasks on deployed instances. Permissions are scoped to specific resources whenever possible.

Key Tasks Enabled by Manage Role

• Increase service quotas for AWS resources.

• Reserve specific EC2 instance types.

• Create S3 buckets for file storage.

• Manage security groups for IP-based access.

• Handle VPC peering.

• Start, stop, or destroy instances.

• Manage MediaConnect flows for streaming.

Additional Resources

• Spacelift AWS Integration

• AWS IAM Documentation