Deploy the CampusCore IAM Role

This is the one manual AWS step on your side of onboarding. You deploy a small CloudFormation template we provide, which creates a single scoped IAM role that lets CampusCore deploy the application into your account - and nothing more. It takes about 10 minutes, and you can review every permission before you run it.

Before you start

You need three things before you begin.

• Access to your AWS account with permission to create CloudFormation stacks and IAM roles.
• The AWS region that CampusCore will run in, which your CampusCore contact confirms with you. Create the stack in that region, because every later deployment updates the stack in the region it deploys to.
• For Options B and C, the template file deploy-role.yaml, provided by your CampusCore contact. It carries everything the stack needs, so there is nothing to paste in.

The stack must be named exactly CampusCore-Deploy-Role, because later deployments look for the stack by that name.

Pick one of the three options below. Option A needs no file and leaves nothing behind in your account, so we recommend it.

Option A: Console link

This link opens the CloudFormation console with our template and the stack name already filled in. Sign in to the AWS Console for the account CampusCore will deploy into, pick your region below, and open the link that appears.

AWS region Choose your region US East (N. Virginia) - us-east-1 US East (Ohio) - us-east-2 US West (N. California) - us-west-1 US West (Oregon) - us-west-2 Africa (Cape Town) - af-south-1 Asia Pacific (Hong Kong) - ap-east-1 Asia Pacific (Taipei) - ap-east-2 Asia Pacific (Mumbai) - ap-south-1 Asia Pacific (Hyderabad) - ap-south-2 Asia Pacific (Tokyo) - ap-northeast-1 Asia Pacific (Seoul) - ap-northeast-2 Asia Pacific (Osaka) - ap-northeast-3 Asia Pacific (Singapore) - ap-southeast-1 Asia Pacific (Sydney) - ap-southeast-2 Asia Pacific (Jakarta) - ap-southeast-3 Asia Pacific (Melbourne) - ap-southeast-4 Asia Pacific (Malaysia) - ap-southeast-5 Asia Pacific (New Zealand) - ap-southeast-6 Asia Pacific (Thailand) - ap-southeast-7 Canada (Central) - ca-central-1 Canada West (Calgary) - ca-west-1 Europe (Frankfurt) - eu-central-1 Europe (Zurich) - eu-central-2 Europe (Ireland) - eu-west-1 Europe (London) - eu-west-2 Europe (Paris) - eu-west-3 Europe (Milan) - eu-south-1 Europe (Spain) - eu-south-2 Europe (Stockholm) - eu-north-1 Israel (Tel Aviv) - il-central-1 Middle East (Bahrain) - me-south-1 Middle East (UAE) - me-central-1 Mexico (Central) - mx-central-1 South America (Sao Paulo) - sa-east-1

Then, in the console:

1. On the Quick create stack page, check that the stack name reads CampusCore-Deploy-Role.
2. Acknowledge that the stack creates IAM resources, and choose Create stack. There are no parameters to fill in.
3. When the stack status is CREATE_COMPLETE, open its Outputs tab and copy the DeployRoleArn value.

If the console cannot load the template

The template sits in a private CampusCore bucket that only the AWS accounts we have listed may read, and we add your account ID to that list before we send you this page. CloudFormation reads the template with your own sign-in, so the console shows an S3 access-denied error in two cases:

• your IAM user or role is not allowed s3:GetObject;
• your AWS Organization has a policy that blocks reads from buckets outside the organization.

In either case, use Option B, which sends the template from your own computer.

Option B: AWS CLI

The CLI sends the template file directly to CloudFormation and creates nothing else in your account. Run this, replacing <your-aws-profile> with your AWS CLI profile and <your-region> with the region from "Before you start":

aws cloudformation deploy \
  --template-file deploy-role.yaml \
  --stack-name CampusCore-Deploy-Role \
  --capabilities CAPABILITY_NAMED_IAM \
  --no-fail-on-empty-changeset \
  --region <your-region> \
  --profile <your-aws-profile>

Then read back the created role's ARN:

aws cloudformation describe-stacks \
  --stack-name CampusCore-Deploy-Role \
  --query 'Stacks[0].Outputs[?OutputKey==`DeployRoleArn`].OutputValue' \
  --output text \
  --region <your-region> \
  --profile <your-aws-profile>

Option C: Upload the template in the console

Use this option only when you cannot use Option A or Option B. A file upload makes CloudFormation create an S3 bucket in your account to hold the file, so the last steps delete it again.

1. In the AWS Console, switch to your region from "Before you start".
2. Open CloudFormation > Create stack > With new resources.
3. Under Specify template, upload the deploy-role.yaml file we gave you.
4. Name the stack exactly CampusCore-Deploy-Role.
5. Acknowledge that the stack creates IAM resources, and create the stack. There are no parameters to fill in.
6. When the stack status is CREATE_COMPLETE, open its Outputs tab and copy the DeployRoleArn value.
7. Open S3 and find the bucket named cf-templates-<random characters>-<your-region>.
8. If the bucket holds only the file you uploaded, choose Empty and confirm, then choose Delete and confirm. If it also holds other files, your account used it for earlier uploads, so delete only the file whose name ends in deploy-role.yaml and keep the bucket.

Nothing needs the uploaded file once the stack exists, because later deployments send the template directly.

Send us the role ARN

Share the DeployRoleArn value with your CampusCore contact. That is the last thing we need to run your first deployment.

What this role can and can't do

The role grants only the permissions needed to provision and run CampusCore in your account - container services (ECS/ECR), the database (RDS), storage (S3), the queue (SQS), networking, load balancing, certificates, logging, and the parameters those services read. It does not grant access to anything else in your account, and everything it creates lives in your account under your control. You can read the exact policy in deploy-role.yaml before deploying.

After this one-time setup, the role updates itself automatically on future deployments, so you never have to repeat these steps.