Connect Amazon Web Services

The Amazon Web Services connector reads IAM principals and policies, EC2 and VPC inventory, security-group rules, the S3 account public-access block, CloudTrail management events and Security Hub findings. With a separate responder role it can propose revoking security-group ingress, deactivating an IAM access key, revoking role sessions and blocking S3 public access. Every change still needs an approved plan.

Before you start

• You need permission in AWS to create a CloudFormation stack and an IAM role in the account.
• In Vigilbase OS you need the integration.manage and credential.manage permissions.

Connect with a CloudFormation stack

You launch a stack in your AWS account that creates one read-only role for Vigilbase. There are no access keys to copy.

1. 1

   Open Integrations, choose Add connection and select Amazon Web Services.

2. 2

   Enter the AWS account ID. It is the 12-digit number in the AWS console account menu. Optionally give the connection a name; it is shown in feeds, evidence and notifications.

3. 3

   Choose Continue. Preparing your stack can take up to a minute.

4. 4

   Create the role in AWS. Choose Open AWS CloudFormation and create the stack. Do not edit it.

5. 5

   Come back here. Once the stack is created, Vigilbase finishes setup on its own. You can also choose Check again.

If Vigilbase finds the role but cannot confirm it requires the external ID, make sure the stack was not edited, then check again. To use another account, choose Use a different AWS account.

If you prefer to create the role yourself, choose Set up the role yourself instead.

Add response actions (optional)

On the connection, choose Add write access, then Get the responder stack. Vigilbase gives you a second stack that creates a separate responder role. It can only make the changes you approve, one plan at a time. All four AWS actions are marked critical, so the person who proposes them can never approve them.

What is not collected

VPC flow logs are not collected yet.