AWS

AWS Cloud Onboarding Guide

Step-by-step instructions for connecting your AWS accounts to Park Your Cloud using IAM roles and CloudFormation. Choose your method below.

See what gets parked on AWS →

Navigate to Accounts and Start AWS Onboarding

Screenshot: AWS Accounts Onboarding - Choose method

Expand

Where you are: The AWS Accounts Onboarding screen.
How to get here: Click Accounts in the top navigation bar, then select AWS from the dropdown.

Option	When to use it
Discover automatically	You have an AWS Organization set up. The system will scan all accounts using an IAM role. Best for most users.
Add manually	You want to add one account at a time, or you do not have organization-wide permissions.

■ Select Discover automatically if you manage multiple AWS accounts under an AWS Organization (recommended).

■ Select Add manually if you only want to add a single account or have limited AWS permissions.

■ Once selected, click the Continue button at the bottom right.

Tip

If unsure, go with Discover automatically. You will still review and confirm each account before it is added.

Configure IAM Role (Step 1 of 5)

Expand

A 5-step wizard on the left sidebar. You are on Step 1: IAM role config.

Note

If you have already onboarded some AWS accounts before, this flow will not affect them. It only adds new accounts not yet onboarded to PYC.

Field	What to enter	Example
IAM Role Name	Name for the IAM role PYC will create in your AWS Management Account.	role_pyc_org
Management Account ID	Your 12-digit AWS Management (root/master) Account ID.	000000000000

Note

At the bottom of the screen you will see an External ID (e.g., pyc-00000000000). This is a unique security token auto-generated by PYC. Copy this value - you will need it when deploying the CloudFormation stack in the next step. Do not change or ignore it.

1Enter your desired IAM Role Name (or keep the default role_pyc_org).

2Enter your AWS Management Account ID.

3Note down or copy the External ID shown at the bottom.

4Click Save, then click Continue.

Create CloudFormation Stack (Step 2 of 5)

Expand

A CloudFormation template file (pyc_management_template.yaml). This template creates an IAM role in your AWS Management Account that allows PYC to list all accounts in your organization.

1Click Download (top right of the code block) to download the YAML file, or click Copy to copy the content.

2Open your AWS Console and go to CloudFormation.

3Create a new Stack and upload this template file.

4When prompted for parameters, use the IAM Role Name from Step 2 (e.g., role_pyc_org) and the External ID (e.g., pyc-00000000000).

5Deploy the stack and wait for status CREATE_COMPLETE in AWS.

6Come back to PYC and click Verify to confirm the role was created successfully.

7Once verified, click Continue.

Why this is needed

This IAM role gives PYC read-only permission to list all AWS accounts under your Organization. Without it, PYC cannot discover accounts automatically.

Configure Account Role (Step 3 of 5)

Expand

A single input field for the IAM Role Name to be created in your individual AWS member accounts.

Field	What to enter	Example
IAM Role Name	Name for the role to be created in each member account. Keep the default or use a custom name.	role_pyc_acc

Note

This is different from the role in Step 2. The Step 2 role was for your Management Account (to list accounts). This role is for each member account (to allow PYC to start/stop EC2 and RDS resources).

1Enter your desired IAM Role Name or keep the default role_pyc_acc.

2Click Save, then click Continue.

Create CloudFormation StackSet (Step 4 of 5)

Expand

Another CloudFormation template (pyc_account_template.yaml). This deploys an IAM role across all your member accounts at once using a StackSet - no need to do it account by account.

1Click Download or Copy to get the template.

2Open your AWS Console and go to CloudFormation > StackSets.

3Create a new StackSet using this template.

4Deploy it to all accounts in your AWS Organization (or specific OUs/accounts if preferred).

5Use the IAM Role Name from Step 4 (e.g., role_pyc_acc) and the same External ID when prompted.

6Wait for the StackSet to complete deployment across all accounts.

7Come back to PYC and click Continue.

Why this is needed

This role gives PYC permission to start and stop EC2 and RDS resources in each member account. The StackSet deploys it to all accounts in one go.

Validate Accounts (Step 5 of 5)

Expand

All 5 steps on the left sidebar are marked Complete. This is the final step of the onboarding wizard.

1Click the Verify button at the bottom right.

2You will see a confirmation message: "Request submitted. Account discovery is in progress and results will be updated shortly."

3Wait for five minutes until the process is complete, then click Finish.

Note

PYC uses the IAM roles you set up to scan your AWS Organization and discover all member accounts. This runs in the background and may take a few moments. Discovered accounts will appear in your Accounts list automatically.

Review Verification Results

Screenshot: Discovered AWS Accounts - verification results

Expand

After you click Verify, PYC runs account discovery in the background. This takes approximately 5 minutes. Once complete, the Discovered AWS Accounts table appears, listing every account PYC found using the CloudFormation stack or StackSet you deployed.

Column	Description
Account ID	The unique AWS account ID discovered by PYC.
Account Name	The display name of the AWS account.
Discovered On	Date and time when PYC first detected this account.
Modified On	Date and time of the most recent update to this account record.
Ready to Onboard	A green checkmark means the IAM role was verified successfully and the account is ready to onboard.
Status	Shows Active when the account is reachable and the role is in place.
Checked On	Date and time when PYC last verified the role for this account.
Execution Details	Shows "Role verified successfully" when setup is correct, or an error message if there is a problem.

■ Refresh reloads the table to pick up any newly discovered accounts.

■ Check Status for All Accounts re-runs role verification for every account in the list at once.

■ Onboard Selected onboards only the accounts you have checked that are ready to onboard.

1Wait for the table to load (about 5 minutes after clicking Verify).

2Review the Ready to Onboard column - a green checkmark means the account is verified and ready.

3If an account shows an error in Execution Details, confirm the CloudFormation stack was deployed correctly in that account.

4Select the checkboxes next to the accounts you want to onboard.

5Click Onboard Selected to complete onboarding for those accounts.

6Click Refresh at any time to update the list.