## 4.3.1.4.2.1  Authorizing Cloud Manager in the Remote Cloud Provider
Learn about the entitlements for the Cloud Manager module in the remote cloud provider required to use the VPC peering feature.
<!-- image -->
##  Restriction
Cloud Manager supports the VPC peering feature of Amazon Web Services and Google Cloud only.
To create VPC peering in SAP BTP, Kyma runtime, you must authorize the Cloud Manager module in the remote cloud provider to accept the connection.
## Amazon Web Services
For cross-account access in Amazon Web Services, Cloud Manager uses AssumeRole . AssumeRole requires specifying the trusted principle. For more information, see the official Amazon Web Services documentation .
Use the following table to identify the Cloud Manager principal. Then, perform the required actions.
BTP Cockpit URL
https:/ /emea.cockpit.btp.cloud.sap
Kyma Dashboard URL
https:/ /dashboard.kyma.cloud.sap
Cloud Manager Principal
```
arn:aws:iam::194230256199: user/cloud-managerpeering-prod
```
1. Create a new role named CloudManagerPeeringRole with a trust policy that allows the Cloud Manager
```
principal to assume the role: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "{CLOUD_MANAGER_PRINCIPAL}" }, "Action": "sts:AssumeRole" } ] } 2. Create a new CloudManagerPeeringAccess managed policy with the following permissions: { "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": [ "ec2:AcceptVpcPeeringConnection", "ec2:DescribeVpcs", "ec2:DescribeVpcPeeringConnections", "ec2:DescribeRouteTables", "ec2:CreateRoute",
```
```
"ec2:CreateTags" ], "Resource": "*" } ] } 3. Attach the CloudManagerPeeringAccess policy to the CloudManagerPeeringRole .
```
## Google Cloud
Grant the following permissions to the Kyma service account in your GCP project:
| Permission                         | Description                                                                         |
|------------------------------------|-------------------------------------------------------------------------------------|
| compute.networks.addPeering        | Required to create the peering request in the remote project and VPC network.       |
| compute.networks.get               | Required to fetch the list of existing VPC peerings from the remote VPC network.    |
| compute.networks.ListEffectiveTags | Required to check if the remote VPC network is tagged with the Kyma shoot name tag. |
It is recommended to create an Identity and Access Management (IAM) custom role with the permissions listed above. For more information, see the official Google Cloud documentation on how to create a custom role or the Authorize Cloud Manager in the Remote Project section in the Creating VPC Peering in Google Cloud tutorial.
## Service Account
Use the following table to identify the Cloud Manager service account:
| BTP Cockpit URL                     | Kyma Dashboard URL                | Cloud Manager Service Account                                            |
|-------------------------------------|-----------------------------------|--------------------------------------------------------------------------|
| https:/ /emea.cockpit.btp.cloud.sap | https:/ /dashboard.kyma.cloud.sap | cloud-manager-peering@sap- ti-dx-kyma-mps- prod.iam.gserviceaccount.c om |
With the service account, you can authorize the Cloud Manager module in the remote project. For more information, see the official Google Cloud documentation on how to grant a single role to a service account or the Authorize Cloud Manager in the Remote Project section in the Creating VPC Peering in Google Cloud tutorial.