Add cloud devices

Add accounts to ASMS when ACE is not connected

Add an AWS account to AFA to analyze data using the AWS access key and secret IDs you provide.

Analyzed data includes all of the security groups protecting EC2 instances and application load balancers (ALBs), from all AWS regions related to the configured access key. AFA separates these instances into groups called security sets. Each AWS security set is a group of instances or ALBs with the same security group and network ACLs, as well as network policies.

This section explains how to add AWS accounts to ASMS when ACE is NOT connected, as follows:

• Network connection
• Permission requirements for AWS
• Add an AWS account to AFA
• Add cloud devices
• Bulk Update of AWS Account Credentials

Network connection

The following diagram shows an ASMS Central Manager connecting to an AWS account via HTTPS-REST (TCP/443).

Permission requirements for AWS

ASMS requires the following permissions for your AWS accounts:

Device analysis

AFA requires minimal read-only access permissions to access AWS and collect data.

This includes the following AWS access keys:

• Access Key ID
• Secret Access Key

We recommend creating a specific IAM user with access keys instead of relying on root user access keys.

The AmazonEC2ReadOnlyAccess policy must be attached to the IAM user.

For example:

This enables the following permissions for ASMS to perform data collection for target AWS accounts:

Required IAM permission*	API permission	Purpose	ASMS functionality
*Click for link to Amazon API Docs
Access level:  READ
ec2:Describe*	describeInstances	Gets all of the AWS data needed for ASMS	Devices tree, network map & TSQ
	describeVpcs		Devices tree, network map & TSQ
	describeSecurityGroups		Policy visibility, TSQ
	describeNetworkAcls		Policy visibility, TSQ
	describeNetworkInterfaces		Network map & TSQ
	describeInternetGateways		VPN support in network map & TSQ
	describeRouteTables		Network map & TSQ
	describeRegions		Devices tree
	describeSubnets		Network map & TSQ
	describeVpnGateways		VPN support in network map & TSQ
	describeVpcPeeringConnections		Network map & TSQ
	describeVpnConnections		VPN support in network map & TSQ
elasticloadbalancing:Describe*	describeLoadBalancers	Gets the specified load balancers or all load balancers	Network map & TSQ
sts:Get*	getCallerIdentity	Gets AWS Account ID by the provided Access Key ID and Secret Access Key	Needed for all supported AWS API calls.

ActiveChange

When ActiveChange is enabled, the IAM user must have read-only permissions, plus the following additional permissions:

#	Required IAM permission*	API permission	Purpose	ASMS functionality
	*Click for link to Amazon API Docs
	Access level:  WRITE
1	ec2:AuthorizeSecurityGroupIngress	AuthorizeSecurityGroupIngress	Adds the specified inbound (ingress) rules to a security group	Active change
2	ec2:RevokeSecurityGroupEgress	RevokeSecurityGroupEgress	Removes the specified outbound (egress) rules from the specified security group	Active change
3	ec2:RevokeSecurityGroupIngress	RevokeSecurityGroupIngress	Removes the specified inbound (ingress) rules from a security group	Active change
4	ec2:AuthorizeSecurityGroupEgress	AuthorizeSecurityGroupEgress	Adds the specified outbound (egress) rules to a security group for use with a VPC	Active change

For example:

Add an AWS account to AFA

You can add an AWS account to ASMS in two ways:

• Using the standard method: Add an account by providing regular credentials - Access Key ID, Secret Access Key

• Using the assume-role method: By using the assumed role method, you can leverage the same authentication credentials for multiple accounts. To implement this, add target AWS accounts to ASMS and configure them to assume the role of an existing AWS base account. During each target account setup, provide the base account's Access Key ID and Secret Access Key and enter the target account's Role ARN.

  Note: The setup of target accounts is a sequential process and does not involve simultaneous onboarding of multiple accounts.

  Note: The base account does not have to be onboarded to ASMS.

Do the following:

1. Access the DEVICES SETUP page. For details, see Access the DEVICES SETUP page.

2. Click New > Devices.

3. In the vendor and device selection page, select Amazon > Web Services (AWS) EC2.

4. Configure the fields and options as needed:

   

   AWS account fields and options using the standard method

   Access Information	The device type is automatically defined. In the Name field, enter the name that you want to appear in the device tree for this account. Tip: Use the account's host or route name.
   Additional Information	Enter the following details to define access to your AWS account: AWS Access Key ID. Enter your access key, supplied by Amazon. AWS Secret Key ID. Enter your secret key, supplied by Amazon. Regions. Select a region. For example: All China (Beijing) GovCloud Tip: If you want to create a custom list of regions that AFA collects data from, see Set Up Specific Regions for Data Collection in AFA.
   Route Collection	Select one of the following to determine how AFA should acquire the device's routing data. Automatic. Automatically generate routing data upon analysis or monitoring. Static Routing Table (URT). Take the device's routing data from a static file that you provide. For details, see Specify routing data manually.
   Proxy	Click Set Proxy Server to configure a proxy server to connect all cloud devices defined in AFA, including both AWS and Azure. For more details, see Define a proxy server .
   ActiveChange	Select Enable ActiveChange for this device. For details, see Implement changes with ActiveChange.
   Options	Select the following options for your AWS account as needed: Real-time change monitoring.Select this option to enable real-time alerting upon configuration changes. For more details, see Configure real-time monitoring. Set user permissions. Select this option to set user permissions for this device.

   AWS account fields and options using the assume-role method

   Access Information	The device type is automatically defined. In the Name field, enter the name that you want to appear in the device tree for this account.   Tip: For example, AWS_Assume_Role
   Additional Information	Enter the following details: Provide the credentials of an existing AWS account: AWS Access Key ID. Enter the access key, supplied by Amazon. AWS Secret Key ID. Enter the secret key, supplied by Amazon. Specify the Region of the new, target account, you wish to onboard to AFA: All China (Beijing) GovCloud Tip: If you want to create a custom list of regions that AFA collects data from, see Set Up Specific Regions for Data Collection in AFA. Assume Role for a Different Account. Select to add a target account that assumes the role of the existing AWS account accessed above. Add the Target Account Role ARN (add the Amazon Resource Name (ARN) of the role to assume.) TIP: Get the Target Account Role ARN in AWS:
   Route Collection	Select one of the following to determine how AFA should acquire the device's routing data. Automatic. Automatically generate routing data upon analysis or monitoring. Static Routing Table (URT). Take the device's routing data from a static file that you provide. For details, see Specify routing data manually.
   Proxy	Click Set Proxy Server to configure a proxy server to connect all cloud devices defined in AFA, including both AWS and Azure. For more details, see Define a proxy server .
   ActiveChange	Select Enable ActiveChange for this device. For details, see Implement changes with ActiveChange.
   Options	Select the following options for your AWS account as needed: Real-time change monitoring.Select this option to enable real-time alerting upon configuration changes. For more details, see Configure real-time monitoring. Set user permissions. Select this option to set user permissions for this device.

5. Click Finish. The new device is added to the device tree.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   1. To select multiple users, press the CTRL button while selecting.

   2. Click OK to close the dialog.

A success message appears to confirm that the account is added.

In the device tree, AWS accounts are shown in three levels: the account, region/VPC, and security group.

For example:

/bin/algosec_conf --verify-proxy-configuration

Bulk Update of AWS Account Credentials

An API facilitates access/key password updating, which some customers require to do periodically for their AWS accounts, without reloading the accounts, which can be very time-consuming. See Bulk update keys of AWS cloud accounts

Device tree display of NSGs

• Attached NSGs: in the device tree, Azure NSGs have a three-tier hierarchy:

  

  1. Subscription (customer-given name for the subscription when onboarded to AFA)

  2. Region/VNet

  3. Security set (a container for one or two NSGs assigned to one or more instances)

     Note; When two NSGs exist in the security set, they are both shown separate by a / (For example, WindowsVM-nsg/DT3019).

• Unattached NSGs: Unattached NSGs include network security groups that are either unassigned or not associated with a VM or App Service Environment (ASE), even if they are linked to an interface or subnet. In the device tree they are shown with the same three-tier hierarchy as attached NSGs except that the second tier is shown as a placeholder virtual network labeled region/"Unattached_Network_Security_Groups".

  Note: Network Map/TSQ/Routing Query are not relevant for unattached NSGs.