Link Amazon Web Services to Docker Cloud

You can create a role with AWS IAM (Identity and Access Management) so that Docker Cloud can provision and manage swarms on your behalf.

Note: Your AWS account must support EC2-VPC in order to deploy swarms, and you must also have an SSH key in each AWS region you will deploy swarms in.

If you used Docker Cloud with AWS to deploy classic Node Clusters, you can add the new policy to your existing role by following the instructions below.

Create a dockercloud-swarm-role role with an embedded policy

1. Go to the AWS IAM Role creation panel at https://console.aws.amazon.com/iam/home#roles. Click Create new role.

2. Select Another AWS account to allow your Docker Cloud account to perform actions in this AWS account.

   

3. In the Account ID field, enter the ID for the Docker Cloud service: 689684103426.

4. Select Require external ID (Best practice when a third party will assume this role).

   • In the External ID field, enter the namespace you will be linking.

     This will either be your Docker Cloud username, or if you are using Organizations in Docker Cloud, the organization name. Failure to use the correct name will result in the following error message: Invalid AWS credentials or insufficient EC2 permissions when attempting to link your Docker account to your AWS account.

   • Leave Require MFA unchecked.

   Click Next Permissions.

5. On the next screen, do not select a policy (you will add the policy in a later step).

   Click Next: Review.

   

6. Give the new role a name, such as dockercloud-swarm-role.

   Note: You must use one role per Docker Cloud account namespace, so if you will be using a single AWS account for multiple Docker Cloud accounts, you should add an identifying namespace to the end of the name. For example, you might have dockercloud-swarm-role-moby and dockercloud-swarm-role-teamawesome.

7. Click Create Role.

   AWS IAM creates the new role and returns you to the Roles list.

8. Click the name of the role you just created to view its details.

9. On the Permissions tab, click + Add an inline policy.

10. On the next page, click Custom Policy and click Select.

11. On the Policy Editor page that appears, give the policy a name like dockercloud-swarm-policy.

12. In the Policy Document section, copy and paste the policy document found in the Docker for AWS page.

    

13. Click Apply Policy.

14. Back on the role view, click into the new role to view details, and copy the full Role ARN string.

    The ARN string should look something like arn:aws:iam::123456789123:role/dockercloud-swarm-role. You’ll use the ARN in the next step.

    

Now skip down to the topic on how to Add your AWS account credentials to Docker Cloud.

Attach a policy for legacy AWS links

If you already have your AWS account connected to Docker Cloud and used the legacy node cluster functionality you will need to create and attach a new policy, and re-link your account.

1. Go to the AWS IAM Roles list at https://console.aws.amazon.com/iam/home#roles.

2. Click your existing version of the dockercloud-role.

3. On the Permissions tab, click + Add an inline policy.

4. On the next page, click Custom Policy and click Select.

5. On the Policy Editor page that appears, give the policy a name like dockercloud-swarm-policy.

6. In the Policy Document section, copy and paste the policy document found in the Docker for AWS page.

7. Click Validate Policy.

8. If the validation succeeds, click Apply Policy.

9. Select and copy the Role ARN on the role screen. It shouldn’t have changed, but you’ll use it to re-link your account.

Because you edited the role’s permissions, you need to re-link to your account. Back in Docker Cloud, click the account menu and select Cloud Settings, and in the Service providers section, click the green plug icon to unlink your AWS account.

Then, follow the instructions below to re-link your account.

Add your AWS account credentials to Docker Cloud

Once you’ve created the a dockercloud-swarm-policy, added the dockercloud-swarm-role inline, and have the role’s Role ARN, go back to Docker Cloud to connect the account.

1. In Docker Cloud, click the account menu at the upper right and select Cloud settings.

2. In the Service providers section, click the plug icon next to Amazon Web Services.

   

3. Enter the full Role ARN for the role you just created.

4. Click Save.

   

You are now ready to deploy a swarm!

Where to go next

Ready to create swarms on AWS? See Create a new swarm on Amazon Web Services in Docker Cloud.

You can get an overivew of topics on swarms in Docker Cloud.

Using Standard Mode to managing Docker nodes on AWS? If you are setting up nodes on AWS in Standard Mode, go back to What’s next in Standard Mode.