Prerequisites:

• PAN-OS version 10.2.4 or above
• AWS Plugin version 5.4.0

Setting Up Monitoring Definitions in AWS Shared VPC

1. Set up a shared VPC.
   1. Create a Shared VPC in your AWS Account.

   2. Create a Subnet within this shared VPC.
   3. Using the AWS Resource Access Manager (RAM) share the subnet with AWS Account.

2. Create virtual machines in the shared subnets in Account A and Account B. For example, create VM1 in Account A and VM2 in Account B within the shared subnet.
3. Configure the IAM roles for cross-account access.
   1. In Account B, go to IAM > Roles > Create Role.
   2. Select AWS Account as the trusted entity type.
   3. Select Another AWS Account and enter Account A’s Account ID.
   4. Assign the AmazonEC2ReadOnlyAccess policy to the role.

   5. Note the Role ARN after creation.
4. In Panorama, configure the AWS plugin for monitoring.
   1. In panorama, go to AWS > NGFW > Set Up > IAM Roles.
   2. Select Account A’s IAM credentials for onboarding.

   3. Create first Monitoring Definition for Account A IAM role, select the VPC-ID of the shared VPC.
      If you try setting up a monitoring definition using the same VPC-ID with the same credentials, the configuration window on Panorama throws an error message on a duplicate entry.

   4. Verify that the AWS portal dashboard displays VM1’s IP address.

5. Create Second Monitoring Definition for Account B.
   1. Create a new Monitoring Definition.
   2. Using Account A’s IAM Role, create a new monitoring definition.
   3. Enter the Role ARN from Account B’s IAM role.

   4. Select the same Shared VPC ID.

   5. After the monitoring retrieval process, verify that the AWS dashboard now displays VM2’s IP address.
      You can also check the VM2’s IP on the Panorama Monitoring Definition Detailed status window.
      If VPC is shared to the third account, you can repeat the step of creating and getting the role ARN from the third account. Create a third monitoring definition to harvest IP-tags from the third account. This provides you the flexibility for device group configurations.
   For the three monitoring definitions that are monitoring the shared VPC in different accounts:
   • If firewalls are separate per account: Assign different plugin notify groups for each monitoring definition.
   • If firewalls are shared across accounts: Use the same plugin notify group for all monitoring definitions.