Permissions and IAM for 1:1 NAT in AWS Cloud WAN

Only the core network owner can view or change the NAT configuration of a core network attachment. This applies to every attachment in the core network, including attachments owned by other accounts when the core network is shared through AWS RAM. Attachment owners can't view or change NAT configuration.

Attachment owners in other accounts do receive the NAT CloudWatch metrics for their attachments.

IAM permissions

Action	Purpose
networkmanager:UpdateAttachmentNatConfiguration	Enable or disable NAT, set NAT system route support, and set NAT rules. Also required to include a NAT configuration when you create an attachment.
networkmanager:ListAttachmentNatConfigurations	View NAT configuration for one or more attachments.

Both actions authorize against the attachment resource: arn:aws:networkmanager::account-id:attachment/attachment-id. To restrict which attachments a principal can manage, specify attachment ARNs or use tag-based conditions.

Create an attachment with a NAT configuration

If you include a NAT configuration when you create an attachment, for example with CreateVpcAttachment, you need permission for both the create action and networkmanager:UpdateAttachmentNatConfiguration. If you have permission for the create action but not for UpdateAttachmentNatConfiguration, a create request that includes a NAT configuration is denied. A create request without a NAT configuration needs only the create permission.

The following example policy lets a principal manage NAT only on attachments tagged environment=prod:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "networkmanager:UpdateAttachmentNatConfiguration",
        "networkmanager:ListAttachmentNatConfigurations"
      ],
      "Resource": "arn:aws:networkmanager::*:attachment/*",
      "Condition": {
        "StringEquals": { "aws:ResourceTag/environment": "prod" }
      }
    }
  ]
}

The following example policy lets a principal create VPC attachments with a NAT configuration:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "networkmanager:CreateVpcAttachment",
        "networkmanager:UpdateAttachmentNatConfiguration"
      ],
      "Resource": "*"
    }
  ]
}

Logging

AWS CloudTrail logs both NAT actions in the US West (Oregon) AWS Region, like other Network Manager API calls. CloudTrail logs a create request that includes a NAT configuration as the create action.