SaaS AWS Cloud Setup (Single Cloud)

Integrating an AWS cloud account with the SaaS version of InsightCloudSec

Once your InsightCloudSec instance is up and running the first thing you'll want to do is integrate an AWS cloud account to take advantage of the security Insights that apply to your cloud footprint. If you have any issues or questions with this setup, reach out to the support team through the Customer Support Portal.

If you need to add multiple accounts grouped under an AWS organization to the SaaS version of InsightCloudSec, review SaaS AWS Cloud Setup (Organizations).

Setup Overview

For InsightCloudSec to securely access the information contained within your AWS cloud account, you'll need to create and setup a role, policy, and trust relationship. Review AWS' IAM documentation for more information on these concepts. To achieve proper harvesting for InsightCloudSec, use the provided CloudFormation Template to complete the following within your AWS cloud account:

  • Create a policy for harvesting the various AWS resources in use. This policy will be attached to a role (with optional External ID) that designates your unique InsightCloudSec role as a trusted entity.

The diagram below outlines the setup required:

AWS Cloud Setup Overview for SaaS versions of InsightCloudSecAWS Cloud Setup Overview for SaaS versions of InsightCloudSec

AWS Cloud Setup Overview for SaaS versions of InsightCloudSec

Prerequisites

📘

Value Names (DivvyCloud vs. InsightCloudSec)

Some components use our former product name (DivvyCloud vs. InsightCloudSec). Updates to the naming of these components will be communicated when changes are made, but note that the name difference does not affect setup or functionality within the product.

Before you configure anything in your AWS environment, you'll need the following:

  • Admin access to the AWS cloud account you want to harvest
  • The unique Amazon Resource Name (ARN) for your InsightCloudSec instance. Your unique InsightCloudSec ARN will look something like this: arn:aws:iam::123456789123:role/DivvyCloud-CustomerName-Install-Role, with the 12-digit account ID and CustomerName values being replaced with your personal values of course
    • Contact your Customer Success Manager or the support team through the Customer Support Portal if you do not have this information
  • Domain Admin permissions within InsightCloudSec
  • IAM CloudFormation Template (CFT) (see below) and basic knowledge on how to use and implement CFTs

CloudFormation Templates

🚧

Using CFTs

If you are unwilling or unable to use the CFTs required for setup, contact the support team through the Customer Support Portal.

Our team maintains the following template to help automate policy and role setup for your cloud account:

  • DivvyCloud-AWS-IAM-Harvest-Role-Member-CFT.yaml -- Deploys a standard harvesting role to a given cloud account to harvest AWS resource data. Note: This CFT is also used in the Organization setup instructions, but it can be used on just one account instead of multiple organization member accounts.

Step 1: Cloud Account Setup

Setting up your AWS cloud account is straightforward -- the account that contains resource data you want to harvest for InsightCloudSec will need a harvesting role and policy attached to it. The relevant CFT for this setup will configure the desired cloud account.

1. Login as an Admin to the AWS account you want to harvest and access the CloudFormation service.

  • This service can be found on the Services main page under Management & Governance. You can also enter "CloudFormation" into the search bar.
  • From the CloudFormation dashboard, click "Stacks" in the left-hand menu.

2. In the top right corner of the Stacks table, click "Create stack --> With new resources (standard)".

3. Configure the template.

  • Click "Template is ready".
  • Click "Amazon S3 URL".
  • Input the Harvest Member Role CFT URL: https://s3.amazonaws.com/get.divvycloud.com/prodserv/divvycloud-deployment-native/aws/cft/iam/DivvyCloud-AWS-IAM-Harvest-Role-Member-CFT.yaml
  • Click "Next".
Uploading the Member Harvest Role StackUploading the Member Harvest Role Stack

Uploading the Member Harvest Role Stack

4. Specify stack details.

  • Provide a name for the Stack.
  • Edit the parameters:
    • Select the "Standard-Managed (read only, AWS managed)" Harvest role type. Review AWS-Managed Supplemental Policy for more information about this policy.
    • Optionally, update the default role and/or policy name.
    • Input the ARN for your InsightCloudSec instance (contains your unique AWS account ID and role name).
      • Contact your Customer Success Manager or the support team through the Customer Support Portal if you do not have this information.
    • Optionally, select "Yes" to create an external ID, then provide an external ID
  • Click "Next".
Specifying the Member Harvest Role DetailsSpecifying the Member Harvest Role Details

Specifying the Member Harvest Role Details

5. Configure stack options.

  • Optionally, provide tags to help identify the stack and/or update the execution configuration.
  • Optionally, provide an IAM admin role to perform all the operations in the Stack within your account(s) and adjust the IAM execution role name as necessary.
  • Optionally, update the stack failure and/or advanced options.
  • Click "Next".

6. Review and create the stack.

  • Review the Stack's configuration to ensure everything is accurate.
  • Acknowledge the warning about IAM capabilities toward the bottom of the page.
  • Click "Submit".
  • Verify the Stack is created successfully.

Step 2: InsightCloudSec Configuration

Now that the AWS account has been configured for harvesting, it's time to enable harvesting within InsightCloudSec.

🚧

Prerequisites

Before you can successfully add an Organization to InsightCloudSec, you will need the following on hand:

  • The ARN/External ID for the account harvesting role (created in step 1)

1. Login to your InsightCloudSec platform and click "Clouds" in the left-hand navigation menu.

  • Click "Add Cloud" in the top right-hand corner.
  • Click "Amazon Web Services".
Add CloudAdd Cloud

Add Cloud

2. Click "Instance Assume Role", then provide a nickname for the account. This creates a system Badge containing the nickname that can be searched or referenced throughout InsightCloudSec.

3. Provide credentials for harvesting the account's data.

  • Provide the Role ARN for the harvesting role (created in step 1)
  • Provide a session name.
    • The session name is what will display in any CloudTrail logs and is useful for auditing purposes.
  • Provide the External ID for the harvesting role (created in step 1), if you created one.

4. Optionally, select a Harvesting Strategy.

5. Click "Add Cloud".

After successful submission, a background job is enqueued that will fetch and synchronize all of your accounts. Depending on the number of accounts this will take a few minutes. At this point, you have the option of validating the permissions on the provided harvesting role to ensure successful harvest, adding cloud Badges, adding another cloud, or returning to the Clouds page.


Did this page help you?