Permissions Required for AWS Accounts
AlgoSec Cloud Enterprise (ACE) comprises two distinct components, each offering a unique set of functionalities:
-
Cloud Network Security (CNS)
-
Cloud App Analyzer (CAA)
This section outlines the required and optional permissions for AWS accounts necessary to fully leverage the capabilities of ACE. The table below details the permissions requested by each specified role, along with justifications for their necessity.
The permissions listed below are classified according to the following key:
| Read | READ permissions | |
| R/W | READ/WRITE permissions | |
| Write | WRITE permissions |
Important: Missing permissions can cause ACE to malfunction and lead to data inconsistencies. AlgoSec is not responsible for any issues arising from missing permissions.
AWS Permissions and justifications
The following required permissions are part of the AWS IAM role:
| Type | Permission | Component | Justification | |
|---|---|---|---|---|
| CNS | CAA | |||
| Read | directconnect:DescribeDirectConnect* |
✔ | For network topology map and TSQ: Permission for ASMS to list all your Direct Connect gateways or only the specified Direct Connect gateway. | |
| Read | ec2:DescribeFlowLogs |
✔ | For Network policy: Permission to flag unused rules. | |
| Read | ec2:DescribeInstances |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve VM instances information | |
| Read | ec2:DescribeInternetGateways |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve internet GW information | |
| Read | ec2:DescribeNetworkAcls |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve network ACLs information. | |
| Read | ec2:DescribeNetworkInterfaces |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve network interfaces information. | |
| Read | ec2:DescribeRegions |
✔ | For Network policy and Risks: Permission to flag unused rules and retrieve availabilityZone. | |
| Read | ec2:DescribeRouteTables |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve route tables information. | |
| Read | ec2:DescribeSecurityGroups |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve Security Groups information. | |
| Read | ec2:DescribeSubnets |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve subnets information. | |
| Read | ec2:DescribeTransitGatewayAttachments |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve Transit GW attachments information. | |
| Read | ec2:DescribeTransitGatewayRouteTables |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve route tables information. | |
| Read | ec2:DescribeTransitGateways |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve VPC peering connections information. | |
| Read | ec2:DescribeVpcPeeringConnections |
✔ | For Overview of assets and security controls, Network policy and Risks: permission to retrieve VPC peering connections information. | |
| Read | ec2:DescribeVpcs |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve VPC information. | |
| Read | ec2:DescribeVpnConnections |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve VPN connections information. | |
| Read | ec2:DescribeVpnGateways |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve VPN GW routes information | |
| Read | ec2:SearchTransitGatewayRoutes |
✔ | For Overview of assets and security controls, Network policy and Risks: Permission to retrieve transit GW routes information | |
| Read | elasticloadbalancing:DescribeTargetGroups |
✔ | For ASMS A33.10+: Permission so that it can show load balancer target groups on the tree. | |
| Read | elasticloadbalancing:DescribeTargetHealth |
✔ | For ASMS A33.10+: Permission so that it can show load balancer target health on the tree. | |
| Read | elasticloadbalancing:DescribeListeners |
✔ | For ASMS A33.10+: Permission so that it can show load balancer listeners on the tree. | |
| Read | elasticloadbalancing:DescribeLoadBalancers |
✔ | For ASMS A33.10+: Permission to show load balancers on the tree. | |
| Read | logs:GetLogEvents |
✔ | Permission to list log events from CloudWatch. The Traffic log is required to determine unused rules. If only S3 is used then this permission is not required | |
| Read | s3:GetBucketLocation |
✔ | For Overview of assets and security controls: Permission to retrieve Storage Bucket information. | |
| Read | s3:GetObject* |
✔ | For Overview of assets and security controls: Permission to retrieve Storage bucket information. If only CloudWatch is used then this permission is not required. | |
| Read | s3:List* |
✔ | For Overview of assets and security controls: Permission to retrieve Storage Bucket information. Also for Cloud Security misconfiguration information. | |
| Read | SecurityAudit Policy | ✔ | For Cloud Security misconfiguration information. | |
| Read | ses:DescribeActiveReceiptRuleSet | ✔ |
For AWS Simple Email Service: Permission to read metadata and receipt rules for the receipt rule set that is currently active. |
|
| Read | logs:DescribeLogGroups | ✔ |
For AWS CloudWatch Logs: Permission to make sure a CloudWatch log group is attached. |
|
| Read | logs:DescribeMetricFilters | ✔ |
For AWS CloudWatch Logs: Permission to detect any missing CloudWatch metric filters. |
|
| Read | dlm:GetLifecyclePolicies | ✔ |
For AWS Data Lifecycle Manager: Permission to parse summary information about the snapshots of individual volumes or multi-volume snapshots for EC2 instances. |
|
| Read | kms:GetKeyRotationStatus | ✔ |
For AWS Key Management Service: Permission to make sure key rotation is enabled for customer-managed keys. |
|
| Read | ecr-public:GetAuthorizationToken | ✔ |
For AWS Elastic Container Registry: Permission to authorize with ECR, so that Cloud App Analyzer could pull public container images for scanning. |
|
| Read | ecr:GetAuthorizationToken | ✔ |
For AWS Elastic Container Registry: Permission to authorize with ECR, so that Cloud App Analyzer could pull private container images for scanning. |
|
| Read | ecr:BatchGetImage | ✔ |
For AWS Elastic Container Registry: Permission to get detailed information about container images. |
|
| Read | ecr:GetDownloadUrlForLayer | ✔ |
For AWS Elastic Container Registry: Permission to obtain download URLs corresponding to container image layers. |
|
| Read | sts:GetServiceBearerToken | ✔ |
For AWS Elastic Container Registry: Permission to authorize with ECR, an additional permission sts:GetServiceBearerToken is required. |
|
| Read |
s3:GetObject (arn:aws:s3:::elasticbeanstalk*) |
✔ |
For AWS Elastic Beanstalk: Permission to make sure Elastic Beanstalk is configured to apply managed platform updates; this specific permission is required if Elastic Beanstalk logs are stored in Amazon S3. |
|
| Read | inspector2:ListFindings | ✔ |
For AWS Inspector 2: Permission to retrieve a subset of information about one or more findings for ECR container images, reported by the AWS built-in vulnerability scanner. |
|
| Read | inspector2:ListCoverage | ✔ |
For AWS Inspector 2: Permission to retrieve the types of statistics Amazon Inspector can generate for the monitored resources. |
|
Additional optional permissions
While the core functionalities of ACE operate seamlessly with the required permissions above, certain advanced features and specialized functionalities necessitate additional optional permissions. These permissions are not essential for the fundamental operations of the platform but are required to leverage enhanced capabilities tailored to specific use cases or integrations. The table below outlines these optional permissions along with their justifications, detailing how they support specialized functionalities within ACE.
Permissions for Changes to AWS Policies
(optional) You will need the following WRITE permissions, if you want to enable:
-
Changes to AWS policies in Cloud Network Security.
-
To make ActiveChange for AWS available in FireFlow when using unified onboarding with AWS. For more information see Simultaneously Onboard AWS Accounts into ACE and ASMS.
The following permissions are part of the AWS IAM role:
| Type | Permission | Component | Justification | |
|---|---|---|---|---|
| CNS | CAA | |||
| Write | ec2:AuthorizeSecurityGroupEgress (optional - for Changes to AWS policies ) |
✔ | For Network policy: Permission for policy provision, to add the specified outbound (egress) rules to a security group for use with a VPC. | |
| Write | ec2:AuthorizeSecurityGroupIngress (optional - for Changes to AWS policies ) |
✔ | For Network policy: Permission for policy provision, to add the specified inbound (ingress) rules to a security group. | |
| Write | ec2:RevokeSecurityGroupEgress (optional - for Changes to AWS policies ) |
✔ | For Network policy: Permission for policy provision, to remove the specified outbound (egress) rules from a security group for EC2-VPC. | |
| Write | ec2:RevokeSecurityGroupIngress (optional - for Changes to AWS policies ) |
✔ | For Network policy: Permission for policy provision, to remove the specified inbound (ingress) rules from a security group. | |
Permissions for CD Mitigation
Note: This permissions is part of the created AWS Stack that App Analyzer creates during onboarding. If the CD Mitigation feature is not required, this permission should be manually removed.
As part of the onboarding, several resources are created in the user's account to support CD mitigation.
| Type | Permission | Component | Justification | |
|---|---|---|---|---|
| CNS | CAA | |||
| R/W | ecr:SetRepositoryPolicy
(optional - for CD Mitigation) |
✔ |
For Elastic Container Registry: Permission to allow setting/changing a policy of a container image, detected to be a high risk, so that it will not be pulled from the registry into a workload. |
|
Permissions for AWS EC2 scanning
| Type | Permission | Component | Justification | |
|---|---|---|---|---|
| CNS | CAA | |||
| Read |
ec2:DescribeSnapshots (optional - for VM scanner) |
✔ |
For VM scanner: Permission to get the relevant data about the snapshots, and make sure they are being deleted |
|
| Read |
ec2:DescribeInstances (optional - for VM scanner) |
✔ |
For VM scanner: : Permission to get the public IP address of the EC2 spot instance |
|
| Read |
ec2:DescribeImages (optional - for VM scanner) |
✔ |
For VM scanner: Permission to get the required AMI for creating the EC2 spot instance that scans the volumes |
|
| Read |
ec2:DescribeVolumes (optional - for VM scanner) |
✔ |
For VM scanner: Permission to choose which volumes/partitions to scan |
|
| Write |
ec2:CreateSnapshots (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create snapshots from the volumes attached to the target EC2 instance |
|
| Write |
ec2:CreateVolume (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a volume from a snapshot |
|
| Write |
ec2:RunInstances (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create an EC2 spot instance that scans the volumes |
|
| Write |
ec2:AttachVolume (optional - for VM scanner) |
✔ |
For VM scanner: Permission to attach the EC2 spot instance a volume to be scanned |
|
| Write |
ec2:CreateTags (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create tags for Cloud App Analyzer VM scanner EC2 temporary resources |
|
| Write |
ec2:TerminateInstances (optional - for VM scanner) |
✔ |
For VM scanner: Permission to delete the temporary EC2 resources after the scan is finished |
|
| Write |
ec2:DeleteSnapshot (optional - for VM scanner) |
✔ | ||
| Write |
ec2:DeleteVolume (optional - for VM scanner) |
✔ | ||
| Write |
ec2:CreateVpc (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a VPC that will be used by all the temporary EC2 spot instances in the region |
|
| Write |
ec2:ModifyVpcAttribute (optional - for VM scanner) |
✔ |
For VM scanner: Permission to apply the required configuration for the created VPC |
|
| Write |
ec2:CreateSubnet (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a Subnet in the VPC |
|
| Write |
ec2:CreateInternetGateway (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create an Internet Gateway to be attached to the VPC, in order to allow communications with Cloud App Analyzer account |
|
| Write |
ec2:AttachInternetGateway (optional - for VM scanner) |
✔ |
For VM scanner: Permission to attach the Internet Gateway to the VPC |
|
| Write |
ec2:CreateRouteTable (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a Route Table in the VPC |
|
| Write |
ec2:AssociateRouteTable (optional - for VM scanner) |
✔ |
For VM scanner: Permission to associate the Route Table to the created Subnet |
|
| Write |
ec2:CreateRoute (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a Route in the Route Table |
|
| Write |
ec2:DeleteVpc (optional - for VM scanner) |
✔ |
For VM scanner: Permission to delete the temporary network resources after the scan is finished |
|
| Write |
ec2:DeleteSubnet (optional - for VM scanner) |
✔ | ||
| Write |
ec2:DeleteInternetGateway (optional - for VM scanner) |
✔ | ||
| Write |
ec2:DetachInternetGateway (optional - for VM scanner) |
✔ | ||
| Write |
ec2:DeleteRouteTable (optional - for VM scanner) |
✔ | ||
| Write |
ec2:DisassociateRouteTable (optional - for VM scanner) |
✔ | ||
| Write |
iam:CreateServiceLinkedRole (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a service linked role as part of the scan resources creation. This role is required for creating the resources |
|
| Write |
kms:ReEncryptFrom (optional - for VM scanner) |
✔ |
For VM scanner: Permission to create a snapshot from a volume that is encrypted using KMS CMK (Customer managed key) |
|
| Write |
kms:ReEncryptTo (optional - for VM scanner) |
✔ | ||
| Write |
kms:CreateGrant (optional - for VM scanner) |
✔ | ||
Permissions for Kubernetes Cluster Scan
The permissions for Kubernetes scan should be granted in the level of the Cluster.
Create a Cluster role with the following permissions:
|
API group |
Resource names |
Resources |
Verbs |
|---|---|---|---|
|
"rbac.authorization.k8s.io" |
- |
roles, rolebindings, clusterroles, clusterrolebindings |
list |
|
"storage.k8s.io" |
- |
storageclasses, volumeattachments |
list |
| "" | - |
nodes |
list |
|
"" |
prevasio-kspm-{ALGOSEC_TENANT_ID} |
namespaces |
create, delete |
Create a cluster role binding to bind this cluster role to the following User:
arn:aws:sts::{account_id}:assumed-role/{Cloud App Analyzer_role_name}/AssumedRoleSession
Create a Role with the following permissions and namespace:
|
API group |
Resource names |
Resources |
Verbs |
Namespace |
|---|---|---|---|---|
|
"batch" |
- |
jobs |
create, delete |
prevasio-kspm-{ALGOSEC_TENANT_ID} |
Create a cluster role binding to bind this role to the following User:
arn:aws:sts::{account_id}:assumed-role/{Cloud App Analyzer_role_name}/AssumedRoleSession.
Create an Access Entry:
"IAM principal ARN" = Prevasio Role ARN and "Access policies" = "AmazonEKSViewPolicy"
If you use only ConfigMap Auth mode, create another Cluster role binding, to bind the "view" built in cluster role to the following User:
arn:aws:sts::{account_id}:assumed-role/{prevasio_role_name}/AssumedRoleSession.
Clear your browser's cache