AWS Integration Setup Guide

This guide walks you through granting SecureStack read-only access to your AWS account for comprehensive cloud security assessment, including infrastructure scanning, IAM analysis, and compliance checks.

Quick Start

We recommend using Cross-Account IAM Roles for the most secure access. This method doesn't require sharing long-lived credentials and allows instant revocation.

Option 1: Cross-Account IAM Role (Recommended)

Cross-account roles are the most secure method for granting access. No credentials are shared, and access can be revoked instantly by deleting the role.

Step-by-Step Instructions

1. Sign in to the AWS IAM Console
2. Navigate to Roles → Create Role
3. Select "Another AWS account" as the trusted entity type
4. Enter the SecureStack AWS account ID: 589062477585
5. Optional but recommended: Check "Require external ID" and enter your company ID (provided during onboarding)
6. Click Next to proceed to permissions
7. Search for and attach the ReadOnlyAccess managed policy
8. Click Next
9. Name the role: SSAPSecurityAssessmentRole
10. Add a description: Read-only access for SecureStack security assessments
11. Click Create role
12. Copy the Role ARN (looks like arn:aws:iam::123456789012:role/SSAPSecurityAssessmentRole)
13. Provide the Role ARN to SecureStack during onboarding

Option 2: IAM User with Access Keys

If cross-account roles aren't feasible in your environment, you can create an IAM user with access keys. This method requires more careful credential management.

Step-by-Step Instructions

1. Sign in to the AWS IAM Console
2. Navigate to Users → Create User
3. Username: ssap-security-scanner
4. Click Next
5. Select "Attach policies directly"
6. Search for and select the ReadOnlyAccess policy
7. Click Next → Create user
8. Click on the newly created user
9. Go to Security credentials tab
10. Click Create access key
11. Select "Third-party service" and acknowledge the recommendation
12. Click Create access key
13. Download the CSV or copy the Access Key ID and Secret Access Key
14. Enter these credentials in SecureStack during onboarding

Required Permissions

The ReadOnlyAccess policy provides comprehensive read access. If you prefer a more restrictive policy, here are the minimum required permissions:

Services We Scan

• EC2: Instances, security groups, VPCs, subnets, NACLs, route tables
• S3: Buckets, bucket policies, ACLs, encryption settings, public access blocks
• RDS: Database instances, clusters, security groups, encryption status
• Lambda: Functions, configurations, environment variables, VPC settings
• IAM: Users, roles, policies, access keys, MFA status (metadata only)
• CloudTrail: Trails, status, logging configuration
• CloudWatch: Alarms, log groups, metrics
• Config: Rules, configuration status, compliance data
• KMS: Key policies, rotation status
• Secrets Manager: Secret metadata (not values)

Custom IAM Policy

For organizations requiring minimal permissions, use this custom policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:Describe*",
        "s3:GetBucket*",
        "s3:ListBucket*",
        "rds:Describe*",
        "lambda:List*",
        "lambda:GetFunction*",
        "iam:List*",
        "iam:Get*",
        "cloudtrail:Describe*",
        "cloudtrail:GetTrailStatus",
        "cloudwatch:Describe*",
        "config:Describe*",
        "kms:Describe*",
        "kms:List*",
        "secretsmanager:ListSecrets"
      ],
      "Resource": "*"
    }
  ]
}

Testing Your Setup

After configuring access, verify the credentials work using the AWS CLI:

For IAM Role

# Assume the role (replace with your role ARN)
aws sts assume-role \
  --role-arn arn:aws:iam::YOUR_ACCOUNT:role/SSAPSecurityAssessmentRole \
  --role-session-name TestSession

# Verify identity
aws sts get-caller-identity

For IAM User

# Set credentials (or use AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY env vars)
aws configure

# Verify identity
aws sts get-caller-identity

# Test read access
aws ec2 describe-instances --max-items 1
aws s3 ls

Multi-Account Setup

For organizations using AWS Organizations with multiple accounts:

1. Create the IAM role in each account you want to scan
2. Use consistent naming (SSAPSecurityAssessmentRole) across accounts
3. Consider using AWS CloudFormation StackSets to deploy the role across all accounts
4. Provide all account IDs and role ARNs during SecureStack onboarding

Troubleshooting

"Access Denied" errors

Verify the IAM role or user has the ReadOnlyAccess policy attached. Check for any Service Control Policies (SCPs) that might be blocking access.

"AssumeRole" fails

Ensure the trust policy includes the SecureStack account ID (589062477585) and that any external ID requirements match.

Missing resources in scan

Some resources may be region-specific. Ensure you've selected all relevant regions during onboarding. SecureStack scans all enabled regions by default.