Configuring Amazon Web Services
SailPoint CIEM collects data on access paths and how networks, objects, and identities could gain access to your organization's Amazon Web Services cloud resources.
To configure SailPoint CIEM with your Amazon Web Services source, you'll need to give it read-only access to your Amazon Web Services infrastructure to create an inventory and read the usage data in your CloudTrail bucket.
You can add all AWS accounts in your organization or connect a single account using the provided CloudFormation templates. You can alternatively manually connect AWS accounts (not recommended).
Important
SailPoint recommends adding all organization accounts, as opposed to single accounts, to allow SailPoint CIEM to display the hierarchy of your AWS cloud.
When you have completed your configuration, you should verify it before registering your AWS account with SailPoint CIEM.
Configuring a Central CloudTrail Bucket
SailPoint CIEM uses CloudTrail logs to track the actions taken by a user, role, or AWS service in your AWS account. You must create or use a bucket owned by a central management account to send CloudTrail logs to SailPoint CIEM.
Important
Some CloudTrail entries delivered by AWS services do not contain the Resource
attribute, which is used to display the last activity on an AWS resource in a Certification Campaign. Your certifiers will still see how the resource was accessed, but may not have full activity data details.
You will set up CloudFormation in the accounts falling under the Management Logging Account and add a policy to the bucket owned by that account. You can have up to 150 CloudTrail ARNs when connecting with SailPoint CIEM. All buckets targeted by a CloudTrail must be configured with the following bucket policy:
-
In the AWS Console, search for or select S3.
-
Search for and select the Management Logging Account bucket you want the CloudTrail logs to be sent to.
-
In the bucket menu, select Permissions and Bucket Policy.
-
In the policy editor, append the following JSON text to the policy:
- Replace
<central-cloud-trail-bucket>
with your bucket name. - Replace
<central-cloud-trail-bucket>
with your bucket name.
- Replace
<central-cloud-trail-bucket>
with your bucket name. - Replace
<central-cloud-trail-bucket>
with your bucket name.
- Replace
-
Replace the 2 instances of
<central-cloud-trail-bucket>
with your bucket name. In this example that would betravis-cloud-trail
. -
Confirm you are using the correct AWS ARN for your Commercial or GovCloud account.
- Commercial accounts:
"arn:aws:iam::874540850173:root"
- GovCloud accounts:
"arn:aws-us-gov:iam::229634586956:root"
- Commercial accounts:
-
Repeat this configuration for all buckets targeted by CloudTrail trails.
-
If you are using a custom KMS key, you must add the following to the KMS key policy associated with the CloudTrail:
Refer to the AWS Documentation on changing a key policy for more information.
Once you have configured your CloudTrail policy bucket, SailPoint recommends connecting all accounts simultaneously using AWS Organizations.
Connecting AWS Organizations
SailPoint provides CloudFormation templates to grant the permissions required to onboard all accounts using AWS Organizations.
-
Follow the AWS directions to create a stack set with service-managed permissions.
- Select Template is ready.
- If you using commercial AWS, upload commercial-stackset.json.
- If you using GovCloud AWS, upload gov-stackset.json.
- Under Deployment regions select a single region. IAM resources are account-level objects and should not be created per region.
This creates a role and policy with sufficient privileges in all member accounts to read data from your AWS cloud.
- Select Template is ready.
-
Follow the AWS directions to create a stack on the root management account.
- Select Template is ready.
- If you using commercial AWS, upload commercial-stack.json.
- If you using GovCloud AWS, upload gov-stack.json.
This creates a role and policy with sufficient privileges in the management account to read data from your AWS cloud.
- Select Template is ready.
-
Follow the AWS directions to create a CloudTrail trail at the organizational or account level. You can also use an existing CloudTrail Amazon Resource Name (ARN). You can use up to 150 CloudTrails to connect with SailPoint CIEM.
- Enable log file validation to deliver log digests to your S3 bucket.
- Enable Management events.
Warning
To avoid Amazon Web Services costs, ensure that you enable only management events in your organization's CloudTrail. If you enable all events or create a new organization trail, you will incur costs. Refer to the CloudTrail pricing for more details.
You should verify your configuration before connecting your source.
Policy Requirements
If you want to use a custom IAM policy, it must contain the minimum permissions SailPoint CIEM needs to read your AWS accounts. If you are using AWS for Identity Center provisioning, use the Identity Center Provisioning Policies.
Use the Commercial or GovCloud tab to view permissions for your AWS setup.
Minimum permissions
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 |
|
- Identity store permissions are related to AWS Identity Center.
- SSO permissions are related to AWS Identity Center.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 |
|
- Identity store permissions are related to AWS Identity Center.
- SSO permissions are related to AWS Identity Center.
Identity Center Provisioning Policy Requirements
To use AWS Identity Center for provisioning, SailPoint CIEM requires additional permissions. The following policies include the minimum permissions and the Identity Center provisioning requirements. Permissions specific to the Identity Center are highlighted.
Use the Commercial or GovCloud tab to view permissions for your AWS setup.
Identity Center provisioning permissions
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 |
|
Connecting Single AWS Source Accounts
If you do not want to add all accounts in your organization, you can add individual accounts. SailPoint provides a CloudFormation template to create a role and CloudTrail allowing access to the objects in your Amazon S3 bucket.
To connect a single account using CloudFormation:
-
In the AWS console, select CloudFormation > Stacks.
-
In Stacks, select the Create stack dropdown menu and choose With new resources (standard).
-
Select Template is ready and Upload a template file.
-
Based on your organization configuration, select the appropriate template:
Use Case Template Use an existing CloudTrail with an existing S3 bucket aws-onboarding-existing-cloudtrail.json Create a CloudTrail to use with an existing S3 Bucket aws-onboarding-nobucket.json Create a CloudTrail and an S3 bucket aws-onboarding.json Use Case Template Use an existing CloudTrail with an existing S3 bucket gov-aws-onboarding-existing-cloudtrail.json Create a CloudTrail to use with an existing S3 Bucket gov-aws-onboarding-nobucket.json Create a CloudTrail and an S3 bucket gov-aws-onboarding.json -
Name your bucket.
-
If you are using an existing S3 bucket, enter the name in the BucketName field. This can be found in the S3 bucket column of your Trails.
-
If you are creating an S3 bucket, name the bucket for collecting CloudTrail logs.
-
-
In the external ID field, paste the external ID provided by SailPoint. This can be found in the Connection Settings section of the CIEM AWS source.
You will use this external ID when creating an IAM role.
-
The template populates the other fields. Continue using the stack wizard, setting the Stack failure option to Roll back all stack resources.
-
Complete the setup and select Create stack.
You should verify your configuration before connecting your source.
Connecting AWS Manually
If you do not have access to CloudFormation, you can manually add AWS accounts within your organization.
Warning
SailPoint strongly recommends using CloudFormation templates with AWS Organizations or single AWS source accounts. Connecting AWS manually can leave gaps in your data by potentially missing AWS accounts in your cloud infrastructure.
Creating an IAM Role
You must create an identity and access management role on your Amazon Web Services source account where you will attach the policy defining what data SailPoint CIEM can read. If you are using manual IAM roles with an AWS organization, you must repeat this process to create a role in each subaccount.
-
Sign in to the Amazon Web Services Management console.
-
Search for "IAM".
-
On the left, select Roles and choose Create role.
-
Select AWS account and choose the Custom trust policy option.
-
Paste the following code in the Custom trust policy window, replacing
<externalId>
with the external ID provided by SailPoint in the Connection Settings section of the CIEM AWS source:- Replace with your external ID.
- Replace with your external ID.
-
Confirm the trust policy contains the correct role ARN:
arn:aws:iam::874540850173:role/ciem_universal
for Commercial accountsarn:aws-us-gov:iam::229634586956:role/ciem_universal
for GovCloud accounts
-
Select the Require external ID option and enter the external ID provided by SailPoint. This can be found in the Connection Settings of the CIEM AWS source.
-
Select Next. You will be taken to the Add Permissions section.
- Select Create policy and choose the JSON tab.
-
Replace the JSON text with the required permissions.
-
Select Next: Tags. Tags are optional.
-
Select Next: Review. Enter an appropriate name and description for the role.
-
Select Create policy. The new policy will be displayed in the list of IAM policies.
-
Select the checkbox next to the new policy and select Next.
-
Enter a role name and details. Review the information and select Create Role. You will be redirected to the Roles page.
-
Search for and select the new role to find its Role ARN. You will need this ARN to connect your AWS source accounts with SailPoint CIEM.
-
If you are creating manual IAM roles to work in an AWS organization, repeat the IAM role creation process for each subaccount.
Caution
- If you do not include a new role in every subaccount, you may have gaps in your data.
- All roles must use the same external ID provided by SailPoint in the Connection Settings of the CIEM AWS source.
Creating a Managed IAM Policy
In order to grant SailPoint CIEM access to your CloudTrail events, you must create a managed IAM policy.
- In IAM, expand Access management in the left menu and select Policies.
- Select Create policy to create a managed policy.
-
Add the following permissions to the JSON file, editing the name of the CloudTrail bucket:
- Replace
YourCloudtrailBucketName
with the name of your CloudTrail bucket. - Replace
YourCloudtrailBucketName
with the name of your CloudTrail bucket.
- Replace
YourCloudtrailBucketName
with the name of your CloudTrail bucket. - Replace
YourCloudtrailBucketName
with the name of your CloudTrail bucket.
- Replace
-
Select Review policy. Enter a name and optional description.
- Select Create policy. This directs you to the policy overview page.
- Select the radio button next to the policy name.
- Select the Policy actions dropdown menu and choose Attach to attach the policy to users, groups, or roles in your accounts.
- Select Attach policy to assign the new managed policy to the role you created previously.
Enabling CloudTrail Logging
After you've created a role with sufficient permissions, you'll need to enable CloudTrail event processing and log delivery. You can use an existing S3 bucket to store the CloudTrail logs or create a new one. SailPoint CIEM supports up to 150 CloudTrails.
- In the Amazon Web Services Management console, select Services and search for "CloudTrail".
- Select Trails to access the CloudTrail service page.
-
Select the trail name you want to use or select Create trail to create an S3 bucket for your CloudTrail logs.
-
Under Storage location, select Create new S3 bucket.
Note
Save your CloudTrail name as you'll need it to register your AWS source cloud accounts.
-
Expand Additional settings.
- For Log file validation, choose Enabled to have log digests delivered to your S3 bucket.
- Complete your trail configuration and select Create trail.
-
Verify that the status of the CloudTrail subscription is healthy by looking for the green check mark in the Status column.
-
Select Save changes.
Verifying Your Configuration
When you have finished connecting your AWS accounts, you should verify the configuration was successful.
To verify your configuration:
-
In the AWS Console IAM service, select Roles.
-
Search for the IAM role created by CloudFormation. Select the role and save its name and ARN. For example,
arn:aws:iam::443361460944:role/SailPointCIEMAuditRoleStack
. -
Select the Trust relationships tab and confirm the principal displays:
874540850173
for Commercial accounts229634586956
for GovCloud accounts
-
Select Policies and search for the IAM role created by CloudFormation. For example, "SailPointCIEMAuditPolicy".
-
Select Permissions and verify the bucket name in the JSON.
- Ensure the policy allows
s3:GetBucketLocation
ands3:ListBucket
actions on the CloudTrail bucket, and thes3:GetObject
action on the S3 bucket contents.
You can also view a summary of these details:
- Go to CloudFormation > Stacks.
- Select the stack.
-
Choose the Parameters tab to view the key values for your configuration.
Use this information to connect your AWS source with SailPoint CIEM.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.