Configure Service Account Permissions for the VMware Aria Automation and VMware Aria Automation Orchestrator Integrations to vSphere for Private Cloud Automation for VMware Cloud Foundation

Assign global permissions in vSphere for the service accounts used for VMware Aria Automation and VMware Aria Automation Orchestrator to vSphere integrations.

UI Procedure

1. Log in to the VI workload domain vCenter Server at https://<vi_workload_vcenter_server_fqdn>/ui as [email protected].

2. From the vSphere Client menu, select Administration.

3. In the left pane, select Access control > Global permissions and click Add.

4. In the Add permission dialog box, enter your values for the VMware Aria Automation service account from the VMware Cloud Foundation Planning and Preparation Workbook, select the Propagate to children check box, and click OK.

5. Repeat the procedure for the VMware Aria Automation Orchestrator service account.

6. Repeat the procedure for each isolated VI workload domain vCenter Server.

PowerShell Procedure

1. Start Windows PowerShell

2. Replace the values in the sample code with values from your VMware Cloud Foundation Planning and Preparation Workbook and run the commands in the PowerShell console.

   $sddcManagerFqdn = "sfo-vcf01.sfo.rainpole.io"
   $sddcManagerUser = "[email protected]"
   $sddcManagerPass =  "VMw@re1!"
   
   $sddcDomainName = "sfo-m01"
   
   $domainFqdn = "sfo.rainpole.io"
   $domainBindUser = "svc-vsphere-ad"
   $domainBindPass =  "VMw@re1!"
   
   $assemblerServiceAccount = "svc-vra-vsphere"
   $assemblerVsphereRoleName = "VMware Aria Automation to vSphere Integration"
   
   $orchestratorServiceAccount = "svc-vro-vsphere"
   $orchestratorVsphereRoleName = "VMware Aria Automation Orchestrator to vSphere Integration"

3. Perform the configuration by running the commands.

   Add-vCenterGlobalPermission -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -sddcDomain $sddcDomainName -domain $domainFqdn -domainBindUser $domainBindUser -domainBindPass $domainBindPass -principal $assemblerServiceAccount -role $assemblerVsphereRoleName -propagate true -type user
   
   Add-vCenterGlobalPermission -server $sddcManagerFqdn -user $sddcManagerUser -pass $sddcManagerPass -sddcDomain $sddcDomainName -domain $domainFqdn -domainBindUser $domainBindUser -domainBindPass $domainBindPass -principal $orchestratorServiceAccount -role $orchestratorVsphereRoleName -propagate true -type user

4. Repeat the procedure for each VMware Cloud Foundation instance.