Integrating SailPoint with Amazon Web Services (AWS)

The SailPoint Amazon Web Services (AWS) connector enables organizations to extend existing identity lifecycle and compliance management capabilities within SailPoint to mission-critical AWS IaaS environments to provide a central point of visibility, administration, and governance across the entire enterprise. This includes policy discovery and access history across all organization accounts, provisioning AWS entities and objects, access review and certification, and federated access support.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of an AWS source.

Supported Features

The AWS supports the following features:

• Load AWS Accounts
• *Provision AWS Accounts
• *Access Certifications (certification of entitlements connected to AWS accounts)
• *Password management

For more information on features, refer to Source Features.

Account Management

• Manage IAM Users under the AWS Account as Accounts
• Aggregate, Refresh Accounts

• Create, Update, Delete, Enable, Disable

  Note

  For more information on enabling and disabling, see IAM User Status.

• Change Password

• Add/Remove Entitlements (Groups, AWS Managed Policies, Customer Managed Policies, Inline Policies)

IAM Entities

• IAM Groups: Aggregate, Refresh
• AWS Managed Policy Management: Aggregate, Refresh
• Customer Managed Policies: Aggregate, Refresh
• Inline Policies: Aggregate, Refresh
• Role Management: Aggregate, Refresh

Tags Management

This connector supports the aggregation and refresh of tags attribute for the following entities:

• IAM User
• IAM Role
• Customer Managed Policy
• Service Control Policy
• Organization Unit
• AWS Account

Organization Entities

This connector supports the following on Organization Entities (managed as group object only):

• AWS Accounts Management: Aggregate, Refresh
• Organization Unit Management: Aggregate, Refresh
• Service Control Policy Management: Aggregate, Refresh

Permissions Management

This connector supports the JSON Policy for Permission Policy and Trust Policy as a direct permission.

The Permission Policy for the following AWS entities are represented as Permissions:

• AWS Managed Policies
• Customer Managed Policies
• Inline Policies
• Service Control Policies

The Trust Policy for the following AWS entity is represented as direct permission:

• Roles

Supported Features Comparison with Cloud Governance

IAM User Status

The following are the SailPoint operations with the corresponding IAM User Status:

Enable

• Set Console Password (This would also activate the Signing Certificate if it is associated with an IAM User.)
• Activates Last Created Access Keys
• Activates Last Created AWS CodeCommit HTTPS Credentials
• Activates Last Created AWS CodeCommit SSH Keys
• Activates Signing Certificates

Disable

• Deletes Console Password
• Inactivates Both Access Keys
• Inactivates Both AWS CodeCommit HTTPS Credentials
• Inactivates All AWS CodeCommit SSH Keys
• Inactivates Signing Certificates

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Examples

Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

• The password policy defined in SailPoint applies to accounts on this source.
• If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to Password Management Overview.

Prerequisites

• Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the Virtual Appliance Reference Guide.
• IAM role authentication requires an AWS EC2 instance to perform aggregation and provisioning operations.
• Based on authentication method, create an IAM user or IAM role and assign required permission to it so that it uses all the cross-account roles.
• Create a customer/Inline managed policy in each AWS account that you want to manage with policy document specified in Multiple Group Object Source Policies and Non Multiple-group Object Source Policies.
• Create Cross Account Roles in each AWS account that you want to manage and attach the appropriate policies to the role.
• Based on the authentication method, create the IAM user or IAM role and assign required permission to it so that it can assume all cross-account roles.

• For each AWS cross-account role, establish the trust relationship with the IAM user or IAM role.

  Note

  Ensure you create the cross-account role across the AWS Accounts with the same name and assign the permissions as mentioned.

• The AWS System Administrator can refine the Permission Policies as needed.

• The IMDS hop limit must be set to 2. Example of expected output:

  aws ec2 --profile dev describe-instances --instance-id i-0c42f9be78225a897 --query 'Reservations[].Instances[].MetadataOptions'
  [
   {
    "State": "applied",
      "HttpTokens": "required",
       "HttpPutResponseHopLimit": 2,
       "HttpEndpoint": "enabled",
      "HttpProtocolIpv6": "disabled",
     "InstanceMetadataTags": "disabled"
   }
  ]
  

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.