Onboard AWS accounts to Cloud Network Security

This topic explains how to onboard AWS accounts to AppViz Cloud Network Security.

For list of required permissions see Permissions required for AWS accounts.

You can choose from three onboarding methods to add new AWS accounts. Whether changes to account resources after onboarding are synced from AWS to AppViz depends on the selected onboarding method.

Onboarding Methods for AWS Accounts

You can onboard new AWS accounts using one of the following methods:

• With script - Use scripts to onboard AWS resources. Changes to account resources after onboarding are automatically synced from AWS to AppViz Cloud Network Security.

• API (single account) - Onboard a single AWS account using the API. Changes to account resources after onboarding are not automatically synced.

• Terraform - Leverage Terraform, an infrastructure-as-code solution, to onboard AWS accounts into AppViz Cloud Network Security. Changes to account resources after onboarding are automatically synced from AWS to AppViz Cloud Network Security.

Onboard AWS accounts

Do the following:

1. In the AppViz Settings area, click ONBOARDING.

   On the Onboarding Managment page that opens, click +Onboard.

2. If you are onboarding your first account, click the New Cloud Account button on the welcome page.

3. Otherwise, click the button and click Next.

   The AWS Onboarding wizard appears.

   

4. Select your preferred method to onboard using the Select Onboarding Method dropdown.

   *Automatically syncs changes to accounts from AWS to AppViz after onboarding.

   Onboarding Method	Description	Automatic sync*
   With script	Uses scripts to onboard AWS resources	Yes
   API (single account)	Onboard a single subscription via API	No
   Terraform	Onboard AWS resources using Terraform	Yes

5. Onboard AWS accounts using your preferred method:

   To onboard AWS resources | With script

   During the onboarding process, AppViz connects with your AWS StackSets and any subsequent changes made to StackSets in AWS such as addition or removal of Stacks (accounts) are automatically reflected in AppViz.

   Do the following:

   1. In the Onboarding wizard for AWS, from the Select Onboarding Method dropdown, select With script to select the onboarding method using scripts.

      The Generate CloudFormation template for account(s) onboarding page appears.

      

   2. Specify the permissions for the role in AWS (these will be embedded in a downloadable CloudFormation template file).

      Permissions settings	Description
      Role permissions	AlgoSec only needs   READ   permissions to provide support for your AWS security policy management. This requirement ensures you can still receive complete security analysis and recommendations while granting the minimal level of access. Write permissions can optionally be added for advanced policy change capabilities. Select Read to fully support your AWS security policy management, security analysis and recommendations. For more information, see AWS Permissions and justifications. (Optional) Select Read/Write for advanced policy change capabilities: Base Read permissions, as described in Additional optional permissions, Additional Write permissions, outlined in Additional optional permissions.
      Retrieve VPC Flow Logs	Select to retrieve VPC Flow Logs (flow logs must enabled in AWS for them to be visible in Cloud Network Security). For more information, see VPC Flow Logs. During the onboarding process, Cloud Network Security connects with your AWS StackSets and any subsequent changes made to StackSets in AWS such as addition or removal of Stacks (accounts) are automatically reflected in AppViz.
      Use the same external ID for all accounts	Select to use the same external ID for all accounts

   3. Click Download Template. The CloudFormation template file is downloaded to your machine.

   4. Log in to the AWS Console Home.

   5. In the AWS Console Home, click CloudFormation.

      

   6. Create single or multiple accounts to sync with AppViz.

      To onboard a single account

      1. Click Stacks.

         

      2. Click Create Stack and select With new resources (standard).

      3. In the Specify Template section, click Upload a Template File. Click Choose file. Browse and select the CloudFormation Template that you downloaded previously. Then click Next.

         

      4. In the Specify Stack details section, give the Stack a name and then click Next.

         Note: The account name displayed in AppViz is initially the AWS account number (ID) of the user who created the Stack (account) in AWS. To edit the account name in AppViz, see Edit account details.

         

      5. On the Configure Stack options screen, click Next.

         

      6. Review the Stack. Select I acknowledge that AWS CloudFormation might create IAM resources.

         

      7. Click Submit. It may take several minutes for the Stack to be created and the account to appear in AppViz.

      To onboard multiple accounts

      1. Click StackSets.

         

      2. Click Create StackSet.

      3. In the Specify Template section, click Upload a Template File. Click Choose file. Browse and select the CloudFormation Template that you downloaded previously. Then click Next.

         

      4. In the Specify StackSet details section, give the StackSet a name and then click Next.

         

         The Configure StackSet options screen appears.

      5. On the Configure StackSet options screen, click Next.

         

         The Deployment locations section appears.

      6. In the Deployment locations section, either:

         • Select Deploy stacks in account (and enter the account numbers)

           

         • Deploy stacks in organizational units (OUs) (and enter the OU IDs)

           

         Note: The account names displayed in AppViz are initially set to the the AWS account numbers (ID). To edit the account names in AppViz, see Edit account details.

      7. In the Specify regions section, select the region(s) where the stack will be created and managed.

         

      8. Set Deployment Options based on the needs and requirements of your system. Then click Next.

         

      9. Review the StackSet. Select I acknowledge that AWS CloudFormation might create IAM resources.

         

      10. Click Submit. It may take several minutes for the StackSets to be created and the accounts to appear in AppViz.

          Tip: You can check the individual stack instances in CloudFormation>StackSets as follows.

          1. Click the created StackSet.

          2. Click the Stack Instance tab and see which accounts were created and their detailed status.

   Note: For issues onboarding AWS accounts, see Troubleshoot AWS onboarding.
   To onboard AWS resources | API (single account)

   You can use API calls to add a single AWS account to AppViz.

   Note: Any changes to an account after onboarding are not synced with AppViz. To delete one or more manually added accounts, see Offboard AWS accounts from AppViz.

   Do the following:

   1. Go to the page Add/edit an AWS account.

   2. Follow the instructions on the page.

   To onboard AWS resources | Terraform

   You can leverage Terraform, the infrastructure-as-code solution, as another option for onboarding your AWS subscriptions into AppViz.

   Do the following:

   1. Integrate the code below into your Terraform toolkit. Make the following parameter value replacements in the Locals section:

      Parameter	Description	Notes
      cf_auth_url	URL to authorize AppViz	For US use: https://app.algosec.com/api/algosaas/auth/v1/access-keys/login For EMEA use: https://api.platform.eu.app.algosec.com/api/algosaas/auth/v1/access-keys/login For ANZ use: https://api.platform.anz.app.algosec.com/api/algosaas/auth/v1/access-keys/login For ME use: https://api.platform.me.app.algosec.com/api/algosaas/auth/v1/access-keys/login For UAE use: https://api.platform.uae.app.algosec.com/api/algosaas/auth/v1/access-keys/login For IND use: https://api.platform.ind.app.algosec.com/api/algosaas/auth/v1/access-keys/login
      cf_url	URL to onboard AWS	For US use: https://api.cloudflow.us.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api For EMEA use: https://api.cloudflow.eu.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api For ANZ use: https://api.cloudflow.anz.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api For ME use: https://api.cloudflow.me.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api For UAE use: https://api.cloudflow.uae.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api For IND use: https://api.cloudflow.ind.app.algosec.com/cloudflow/api/admin/v1/onboarding/aws/api
      tenantId	Your AppViz Tenant ID
      clientId	Client ID	This is part of Access Key details. In AppViz, go to Access Management > API ACCESS tab. Create a new API Access Key or use an existing one. See here.
      clientSecret	Client Secret of the API Access Key	This is part of Access Key details. In AppViz, go to Access Management > API ACCESS tab. Create a new API Access Key or use an existing one. See here.

      Copy

      locals {
        cf_auth_url  = "xxxxxxxxxxxxxxxxx"
        cf_url       = "xxxxxxxxxxxxxxxxx"
        cf_tenant    = "xxxxxxxxxxxxxxxxx"
        cf_client_id = "xxxxxxxxxxxxxxxxx"
        cf_secret    = "xxxxxxxxxxxxxxxxx"
      }
      
      data "http" "cf_auth" {
        url    = local.cf_auth_url
        method = "POST"
        # Optional request headers
        request_headers = {
          Accept = "application/json"
        }
        request_body = jsonencode({ tenantId : local.cf_tenant, clientId : local.cf_client_id, clientSecret : local.cf_secret })
        lifecycle {
          postcondition {
            condition     = contains([200, 201, 204], self.status_code)
            error_message = "Authorization failed"
      
          }
        }
      }
      
      locals {
        auth_response = jsondecode(data.http.cf_auth.response_body)
        auth_token    = local.auth_response.access_token
      }
      
      data "http" "cf_onboard_account" {
        url    = local.cf_url
        method = "POST"
        request_headers = {
          Accept        = "application/json"
          Authorization = "Bearer ${local.auth_token}"
        }
        request_body = jsonencode({
          "roleArn" : "arn:aws:iam::xxx:role/CloudFlowRole ",
          "externalId" : "algosec-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
          "name" : "test",
          "supportChanges" : false,
          "flowLogs" : false
        })
        lifecycle {
          postcondition {
            condition     = contains([200, 201, 204], self.status_code)
            error_message = "Authorization failed"
          }
        }
      }
      
      ######################################################################
      # Print the created data to console
      
      output "onboard_status" {
        value = data.http.cf_onboard_account.status_code
      }

Permissions required for AWS roles

See Permissions required for AWS accounts.

Update details of onboarded AWS accounts

You can update the details for AWS resources already onboarded to AppViz. This is helpful if you need to add or remove write permissions.

Offboard AWS accounts from AppViz

If you remove onboarded accounts from AWS, they will not automatically disappear from Cloud Network Security. Avoid discrepancies in your account management by following these steps to manually offboard accounts from AppViz.

You can offboard AWS accounts from AppViz using any of the following methods:

• AWS Console

• API

  1. Go to the page Delete an AWS account.

  2. Follow the instructions on the page.

• CLI

  Do the following:

  From the AWS CLI run the following command:

  aws cloudformation delete-stack --stack-name <stack-name>

  Note: Replace <stack-name> with the name of the stack to offboard.