# Cloud provider setup

> Set up Microsoft Azure as a cloud provider to prepare Orchestrator for connection to your Azure environment.

## Setup in Azure

If your cloud service provider is Microsoft Azure, follow the instructions in this section to prepare to connect Orchestrator to Azure.

:::note
If you are not the Azure administrator, skip this section and instead reach out to your IT team to perform these steps and ask them to provide the details listed under [Azure Requirements](https://docs.uipath.com/robot/automation-cloud/latest/user-guide/requirements#azure-requirements).
:::

1. Sign in to Azure with an administrator account.
2. Navigate to **App registrations** and [create an app registration](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application) for your Orchestrator instance.
3. Copy the **Application (Client) ID** and **Directory (Tenant) ID** and save them for later use.

Figure 1. Application (Client) ID and Directory (Tenant) ID fields

![Screenshot of the Application Client ID and Directory Tenant ID fields](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-application-client-id-and-directory-tenant-id-fields-227027-36de5d7d-045c498f.webp)

4. Navigate to **Certificates & secrets** and [create a client secret](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#add-a-client-secret).
5. Copy the **Value** of the client secret and save it for later use.

Figure 2. Client secret

   ![Screenshot of the client secret](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-client-secret-228426-4eb7e5b4-02e353c1.webp)

6. Navigate to **Resource groups** and [create a resource group](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal#create-resource-groups) for your Orchestrator.
7. Copy the **Subscription ID** and save it for later use.

If you already have a resource group that you want to use, open the overview for that resource group to get the **Subscription ID**.

Figure 3. Subscription ID ![Screenshot of the Subscription ID field](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-subscription-id-field-226295-750c0d8d-56151fbc.webp)

8. Navigate to **Access Control (IAM)**, search for the name you gave to your Orchestrator app registration, and [assign the Contributor role](https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal) to it.

### Preparing a virtual machine image

:::note
If you intend to use customized VMs instead of a template VM, skip this section and instead create the VMs you want to use for elastic robot orchestration.
:::

Robots need a machine on which to run. As part of elastic robot orchestration, we can use your cloud-hosted virtual machine (VM) to create machines on demand for robots to run when needed.

When creating a virtual machine in Azure, Microsoft provides a set of images to build your virtual machines. They are images of different operating systems, such as Windows Server or Windows 10 Pro, that allow you to install the software you need to run automation jobs.

To capture a virtual machine image:

1. Create a virtual machine in your Azure account and connect to it:
   1. Navigate to **Virtual machines** and [create a virtual machine](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quick-create-portal#create-virtual-machine) for the resource group you created earlier.
   2. [Connect to your virtual machine](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quick-create-portal#connect-to-virtual-machine).
2. Create the local user and install the needed automation software:
   :::important
   Do not join the virtual machine to a domain.
   :::

   1. Update Windows and reboot if necessary.
   2. Create a local user for the unattended robot (for example, `uirobot`). Assign the **Administrator** role to the local user, clear **User must change password at next login**, and select **Password never expires**.
   3. Grant remote access permissions on the virtual machine to the local user.
   4. Log out from the administrator account and log in as the local user.
   5. Install any supporting software you need for automations, such as Microsoft Excel or Google Chrome. If your automations interact with a browser or remote desktop application, also install the relevant UiPath extensions, such as the Chrome extension, Edge extension, Remote Desktop extension, or Citrix extension. You do not need to install the UiPath Robot or other UiPath platform software. We handle that automatically.
   6. Log out from the robot account and log in as an administrator.
      :::important
      If you have installed the robot (optional), make sure you do **not** connect it to Orchestrator, otherwise you won't be able to use the Virtual Machine image.
      :::
3. Create a [generalized](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/imaging#generalized-images) Virtual Machine image:

Use the **Sysprep** tool to [generalize the virtual machine](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/capture-image-resource#generalize-the-windows-vm-using-sysprep).
:::note
`sysprep.exe` disconnects your session halfway through.
:::

Figure 4. System Preparation Tool ![Screenshot of the System Preparation Tool](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-system-preparation-tool-229614-6c1b1435-1fdea0e3.webp)

4. After the status of the virtual machine changes to **Stopped**, [create a managed image](https://docs.microsoft.com/en-us/azure/virtual-machines/windows/capture-image-resource#create-a-managed-image-in-the-portal) of your virtual machine.
:::note
Select the same resource group as for the virtual machine. Also, select **No, capture only a managed image**.
:::

You now have a fully configured image that you can use to create new virtual machines for automation.

## Setup in AWS

If your cloud services provider is Amazon Web Services (AWS), follow the instructions in this section to configure Amazon Elastic Compute Cloud (Amazon EC2) for elastic robot orchestration.

:::note
If you are not the AWS administrator, skip this section and instead reach out to your IT team to perform these steps and ask them to provide the details listed under [AWS Requirements](https://docs.uipath.com/robot/automation-cloud/latest/user-guide/requirements#aws-requirements).
:::

### AWS best practices

**Choosing the right AWS region**: Ensure Amazon Virtual Private Cloud (Amazon VPC) is located in an appropriate region. We recommend you always pick the AWS region that is closest to the region where your Orchestrator instance is hosted when creating an elastic robot pool. Consider both latency and [data transfer costs](https://aws.amazon.com/ec2/pricing/on-demand/#Data_Transfer) between Orchestrator, Robots, and the customer application when determining the location of the VPC. Contact the [UiPath support](https://customerportal.uipath.com/support/add-case) team for details on how to allocate all your assets close to each other. Learn more about [regions and instances](https://docs.uipath.com/automation-cloud/automation-cloud/latest/admin-guide/data-residency-cloud) in the Getting Started guide.

**Capacity and cost optimization**: Ensure Amazon Elastic Compute Cloud (Amazon EC2) resources are sized appropriately according to the deployment, customer requirements, and UiPath best practices. Amazon EC2 passes on to you the financial benefits of Amazon’s scale. See [Amazon EC2 Instance Purchasing Options](https://aws.amazon.com/ec2/pricing/) for a more detailed description of Amazon EC2 pricing. UiPath allows you to use your existing machines to take advantage of your optimized EC2 size configuration. We recommend downsizing or terminating idle or underutilized Amazon EC2 instances to optimize costs.

**Calculate the costs**: You can use the [AWS pricing calculator](https://calculator.aws/#/) to get an estimate of Total Cost of Ownership (TCO) for UiPath infrastructure deployed on AWS, by using the AWS label `UiPath:Managed: true`. The cost displayed in the calculator is for the infrastructure only. To get a more accurate TCO value, also consider the cost of UiPath licenses.

**Profiles:** For VMs hosted in AWS, the AWS EC2 Instance must have the `AmazonSSMManagedInstanceCore` instance profile attached. For instructions, see the [AWS documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/security_iam_service-with-iam.html).

### Generate an AWS access key

1. Log in to the Amazon EC2 console as a user who has the following permissions:

   | Permission Category | Read / List | Update | Create | Delete |
   | --- | --- | --- | --- | --- |
   | ec2:* | All | All | All | All |
   | cloudformation:* | All | All | All | All |
   | ssm:* | All | All | All | All |
   | iam.* | iam:GetInstanceProfile  iam:ListInstanceProfiles  iam:GetRole  iam:ListRoles | iam:PutRole  iam:PutRolePolicy  iam:PassRole | iam:AddRoleToInstanceProfile  iam:CreateInstanceProfile  iam:CreateRole | iam:RemoveRoleFromInstanceProfile  iam:DeleteInstanceProfile  iam:DeleteRole  iam:DeleteRolePolicy |
2. Follow the Amazon documentation to [create an access key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys).
3. Save the **access key ID** and **secret access key** for later use.

### Create an AWS EC2 image

:::note
If you intend to use customized VMs instead of a template VM, skip this section and instead create the VMs you want to use for elastic robot orchestration.
:::

1. Log in to the Amazon EC2 console.
2. Follow the Amazon documentation to [create an AWS EC2 instance](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html#how-to-create-windows-ebs-ami) and perform the following as part of the process:
   1. For the AMI, choose a Windows 10 or a Windows Server image. If one does not exist, you must create it.
   2. While connected over RDP, install any Windows updates and reboot if necessary.
   3. After rebooting, install any supporting applications you need for automations, such as Microsoft Excel or Google Chrome. If your automations interact with a browser or remote desktop application, also install the relevant UiPath extensions, such as the Chrome extension, Edge extension, Remote Desktop extension, or Citrix extension. You do not need to install the UiPath Robot or other UiPath platform software. We handle that automatically.
   4. Delete the folder **C:\Windows\Panther**.
   5. Create a Windows local user for the robot, for example, `robot` and grant remote desktop rights to it.
   6. Select **Ctrl** + **Alt** + **Delete** and change the password for the robot user.
   7. Open the **Ec2 Launch Settings** and Select **Shutdown with Sysprep** along the bottom.

Sysprep is a Microsoft tool and you use it to [create a generalized machine image for EC2](https://aws.amazon.com/premiumsupport/knowledge-center/sysprep-create-install-ec2-windows-amis/).
3. After Sysprep finishes, in the Amazon EC2 console, wait for the instance to shut down, then right-Select and go to **Image and templates** > **Create image**:

Figure 5. Create image

   ![Screenshot of the Create image menu](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-create-image-menu-227139-f6554734-71256071.webp)

You can see the new image in the Amazon EC2 console, on the left under **Images** > **AMIs**. You now have a fully configured image that you can use to create new virtual machines for automation.

### Implementing role-based authentication

Implementing role-based authentication helps security, since the credentials provided to a role are temporary. This limits the potential impact if they are compromised.

To set up the Identity and Access Management (IAM) role-based authentication:

1. Add your provider: go to the **AWS Console** > **Identity and Access Management (IAM)** > **IAM Dashboard** page.
   1. Under **IAM resources**, select **Identity providers**.
   2. Select **Add provider**.
   3. For the **Provider type**, select **OpenID Connect**.
   4. In the **Provider URL** field, write:
      * For Automation Cloud and Test Cloud: `sts.windows.net/d8353d2a-b153-4d17-8827-902c51f72357/`.
      * For Automation Cloud Public Sector: `sts.windows.net/79b01b45-e550-41ea-94fa-9494e849c1e8/`.
   5. In the **Audience** field, write:
      * For Automation Cloud and Test Cloud: `55640c46-3d06-4875-9c8a-624cad15aaf7`.
      * For Automation Cloud Public Sector: `c7598ef8-63c4-47e8-86b8-ac795602f7e2`.
   6. Finish the provider configuration by hitting **Add provider**.
2. Configure the policy: go to the **IAM Dashboard** page.
   1. Under **IAM resources**, select **Policies**.
   2. Select **Create policy**.
   3. Switch to the **JSON** option.
   4. In the **Policy editor**, copy-paste the following policy in JSON format:
      ```
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "ec2:*",
              "cloudformation:*",
              "ssm:*",
              "iam:GetInstanceProfile",
              "iam:ListInstanceProfiles",
              "iam:GetRole",
              "iam:ListRoles",
              "iam:PutRolePolicy",
              "iam:PassRole",
              "iam:AddRoleToInstanceProfile",
              "iam:CreateInstanceProfile",
              "iam:CreateRole",
              "iam:RemoveRoleFromInstanceProfile",
              "iam:DeleteInstanceProfile",
              "iam:DeleteRole",
              "iam:DeleteRolePolicy",
              "iam:TagRole",
              "iam:TagInstanceProfile"
            ],
            "Resource": "*"
          }
        ]
      }
      ```
   5. Select **Next**.
   6. Provide a **Policy name** and, optionally, a **Description**.
   7. Finish the policy configuration by hitting **Create policy**.
3. Create and configure roles: go to the **IAM Dashboard** page.
   1. Under **IAM resources**, select **Roles**.
   2. Select **Create role**.
   3. For the **Trusted entity type**, select **Web Identity**.
   4. In the **Identity provider** field, write the same value used in step 1, for the **Provider URL** field.
   5. In the **Audience** field, write the same value used in step 1, for the **Audience** field.
   6. Select **Next** to add permissions.
   7. In the **Permissions policies** field, search for the policy created in step 2, then select it.
   8. Select **Next** for final configurations.
   9. Provide a **Role name** and, optionally, a **Description**.
   10. Finish the role configuration by hitting **Create role**.
4. Copy the **Role ARN** of the newly created role:
   1. Go to the **IAM Dashboard** page.
   2. Select **Roles** from the left-side panel. This opens the **Roles** page.
   3. Under **Summary**, copy the value for the **ARN**.
5. Paste the role ARN value when setting up the AWS connection in Orchestrator.

The Role ARN ID field is displayed after you select the ARN Based Authentication.

## Setup in GCP

If your cloud service provider is Google Cloud Platform (GCP), follow the instructions in this section to prepare to connect Orchestrator to GCP.

:::note
If you are not the GCP administrator, skip this section and instead reach out to your IT team to perform these steps and ask them to provide the details listed under [GCP Requirements](https://docs.uipath.com/robot/automation-cloud/latest/user-guide/requirements#gcp-requirements).
:::

1. [Create a new project](https://cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project) in GCP.
2. [Get the Project ID](https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects) and save it for later use.
3. [Create a service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts#creating) in your GCP project.
4. [Create a service account key in JSON](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#creating_service_account_keys) and save the **Private Key** value for later use.

### Creating virtual machines

If you want to use elastic robot orchestration and have us create machines for you on demand, you must [create custom machine images](https://cloud.google.com/compute/docs/instances/windows/creating-windows-os-image#creating_windows_image) in your GCP project.

The following instructions are a **sample** configuration for creating an image from a persistent disk, which is created from an existing Windows VM you have under your project.

1. Log in to the Google Cloud Console.
2. Select **Compute Engine**, and then under **Virtual machines** Select **VM instances**.
3. Select **Create Instance** at the top of the page.
4. Fill in the details as follows:
   * For **Name**,**Region**, and **Zone**, you can specify whatever you want.
   * For **Machine configuration**, you can leave the default values.
   * Under **Boot disk**, click **Change** and then click **Public Images**.
   * For **Operating system**, select **Windows**.
   * Under **Version** select any of the Windows Server 2019 options.
   * You can accept the defaults for **Boot disk type** and **Size (GB)**, or you can modify them according to your needs.
5. Select **Create**.
6. After boot disk is ready, you can Select **Create** and GCP creates the virtual machine (VM) for you.
7. To be able to use a custom image created from the VM, stop the VM you just created.
8. At the side of the page, go to **Storage** and Select **Images**.
9. At the top of the page, Select **Create Image**.
10. Continue with [these instructions](https://cloud.google.com/compute/docs/instances/windows/creating-windows-os-image#creating_windows_image) to create a Windows image.