- [Bohan] Hello, my name is Bohan Li.
I'm a senior security consultant with AWS.
Today, I'm going to show you
how to share Incident Manager contacts and escalation plans
using AWS Resource Access Manager, RAM.
AWS Resource Access Manager, or RAM,
allows you to share your resources with any AWS account
or through AWS Organizations.
With RAM, it allows you to essentially manage
and govern your resources across your accounts.
So, what are the benefits of using RAM?
First and foremost, it eliminates the need
of creating duplicated resources in every account,
therefore, reduces operational overhead.
Secondly, it provides security and consistency
'cause it allows you to simplify security management
for your shared resources
using a single set of policies and permissions.
It also provides visibility and auditability
'cause you are able to view the usage details
for your shared resources
by integrating with Amazon CloudWatch and AWS CloudTrail.
In this demo, we're going to use RAM
to share Incident Manager resources.
Incident Manager is a feature of AWS Systems Manager.
It helps you prepare for incidents
with automated response plans
that bring the right people and information together.
Incident Manager contacts are responders to incidents,
and escalation plans are escalation path
through your defined contacts.
In this demo, we're going to use two AWS accounts
under the same AWS Organization.
First, we'll create Incident Manager contacts
and escalation plans in the resource owner account.
Then, we'll share the resources with the consumer account.
This will allow the consumer account
to use shared contacts and escalation plan
for responding to an incident.
Now, we're at resource owner account.
Let's go to Incident Manager under AWS Systems Manager.
(no audio)
I have already created two contacts
under Incident Manager,
senior incident responder and incident responder.
I've also created an escalation plan named demo.
Let's take a look.
In this escalation plan,
it has two stages.
It will first contact incident responder.
After a minute,
it will escalate to senior incident responder.
Now we have Incident Manager resources created,
let's share the resource with the other account
via Resource Access Manager.
Here we are at AWS RAM's console.
Let's go ahead and create a resource share.
We're gonna give the name of the demo,
and then we need to select the resource types.
I want to share both escalation plans and the contacts.
Click on Next.
Then, we need to specify the permissions.
For each shareable resource type of AWS RAM,
there is at least one AWS RAM managed permissions.
The permission will define the actions that the principal
with access to the resources in the resource share
are allowed to perform.
Some resource types
have only one AWC RAM managed permission,
which is the case of Incident Manager,
and it will be used automatically.
Some resource types define more than one managed permission,
and, if that's the case,
you can choose which one to use in the resource share.
Then, we need to specify principles.
In this demo,
I want to only allow sharing within my organization.
Then, I wanted to share the resources
within my entire organization.
I have noted down the organization ID for this demo.
So I'm going to copy and paste it,
(no audio)
and then click on Next.
Finally, we'll review all the information,
(no audio)
and then create the resource share.
Resource sharing has been completed.
Now, we are at the resource consumer account.
Let's go confirm if the shared resources are there.
We're at the RAM console,
and, under shared with me, let's go to shared resources.
As we can see,
the Incident Manager contacts and execution plans
have been shared successfully.
We can also confirm from Incident Manager console.
(no audio)
Under Contacts,
we're able to see shared contacts
as well as shared escalate.
Now, in the consumer account,
we have shared contacts and escalation plans.
Lets try to create a response plan
that ties everything together.
We'll select Create Response Plan.
Give a name,
a title,
and then the level of the impact.
I'm going to skip chat channel configuration for this demo.
Now, in the engagement,
you can choose the escalation plan
and then the contacts you created earlier.
As you can see, those are shared contacts
and escalation plans with consumer accounts.
We can also create a runbook.
In this demo,
I'm going to select an existing runbook.
(no audio)
I'm going select block
as the public access configuration.
(no audio)
Account ID.
For this demo, I have pre-created a role
that is needed to allow automation
to perform the action on your behalf.
Continue on.
These are the parameters
that I'm going to pass into the automation.
I've also pre-created a role that is needed
to run the SSM automation document.
A response plan has been created successfully.
In this demo, I showed you how to share
Incident Manager contacts and escalation plans
using AWS Resource Access Manager.
It allows you to create and manage contacts
and escalation plans essentially
and ensure the other accounts
can engage the correct contacts during an incident.