At Stax, we're constantly working to improve our offerings. In order to do this, you'll find that periodically you'll be asked to update the IAM role you created so Stax can get the data we need to make things easy.

Why is this a thing? Because we ask for the 'least privilege' we need at all times, we occasionally need to ask for access to new services and features as they become available. Why do we always ask for least privilege? Because we want to ensure that all your AWS accounts are secure, and it's best practice!

Depending on your AWS Account setup, you may need to run this on one or on many different accounts.

The following applies if you added your accounts either using the new Wizard, or via the old method of running the template manually. If you're unsure at any point, please contact support and we'll be able to assist.

For each account, you'll need to:

  1. Log in to the AWS console, ensure you're using the same region you provisioned Stax in.
  2. Switch to CloudFormation, and under the list of stacks, find the one to provision your Stax role. Typically, this will be something like Stax-IAM-role.
  3. Click into the given stack.
  4. On the right hand of the screen, select "Update Stack"
  5. Now, the the "Choose a Template" selector, pick "Specify an Amazon S3 template URL". 

Depending on the type of account you're updating, there are two different URLs to choose from:

  1. If it's a Billing account (e.g. it has a billing bucket attached, or is the root of an Organisation) - you'll want to use: https://stax-public-resources.s3.amazonaws.com/stax-iam-role-billing-cfn.json
  2. If it's a Service account (everything without a billing account), you'll want to use: https://stax-public-resources.s3.amazonaws.com/stax-iam-role-service-cfn.json

Now, to continue updating the stack:

  1. Hit Next
  2. Leave the existing values as is and press next- They should all match up and be correct, there is no need to change what is already specified. If you have an error about them, you may have specified the wrong type of account.
  3. Scroll to the bottom of the options page and press Next again.
  4. Tick I acknowledge that AWS CloudFormation might create IAM resources. and then press update. This simple updates our IAM role, so this is to be expected.

Finally, you'll be redirected back to the list of stacks on success. Give it a 5-10 minutes, and then check the state of the Stack (e.g. Stax-IAM-role) we talked about earlier - it should ideally be UPDATE_COMPLETE If it isn't, then please contact support and we'll be able to help.

Did this answer your question?