Walkthrough: Onboarding the AWS Cloud connector

This walkthrough shows you how to onboard the AWS Cloud connector to specify and evaluate the AWS account details against the OOB AWS policies at a scheduled interval.

The AWS Cloud connector, hosted by BMC Helix Cloud Security in the AWS platform, gathers data about the following AWS services:

CloudTrails domains
ElasticSearch
Identity and Access Management (IAM) credentials
Password Policy
Rapid Database System (RDS)
S3 bucket
SecurityGroups
Key Management Service (KMS)
Virtual Private Cloud (VPC)
EC2-ELB
EC2-Instances
Simple Notification Service (SNS)
Config

Scenario

A company's Line Of Business (LOB) IT personnel and compliance officers are responsible for ensuring that their Amazon Web Services (AWS) account adheres to industry and organizational standards. To begin this analysis, they want to set up a AWS Cloud connector that will enable them to collect data so that they can evaluate resources and remediate any violations against AWS polices.

Step

Example screens

Log on to BMC Helix Cloud Security with your registered credentials and select Configure icon > Connectors.

On the Manage Connector page, select Add Connector.

Under Connector Type > Cloud Based Connectors (Hosted), click AWS Cloud Connector and then click Continue.

On the Configure Connector screen:

Specify a name for the connector.
If using Key Based authentication, specify the following:
1. AWS Account Access Key for the account to be scanned.
2. AWS Account Secret Key for the account to be scanned.
If using Role Based authentication, specify the following:

1. Role ARN for the user created in IAM.
2. External ID to be used for the user.

3. Select required mode from the two different Collection Mode available, namely, On Demand and Scheduled.

1. On Demand: You can run the scan whenever you choose.

2. Scheduled: You must set the time in which AWS resources should be collected and evaluated periodically.

4. Under AWS Partition, select the required option from AWS (default) or AWS GovCloud (US).

AWS GovCloud (US) is used for scanning resources in AWS Gov cloud region(us-gov-west-1).

On Demand Mode	Scheduled Mode

AWS (default)	AWS GovCloud (US)

Click Continue.

Best practice

For security reasons, BMC recommends that you create a separate IAM user for the AWS account with read-only privileges for the services that you would like to evaluate.

On the Select Policies screen, clear the default compliance policies that you would not use to evaluate your AWS account.

Click Continue.
The connector is available in Cloud Security and the policies can be evaluated on the schedule you have set. Because the AWS Cloud connector resides in the cloud, the connector is always running.

However, for the on-premise connectors, you need to unzip the connector download and then execute the run.bat file or the run.sh file to start the connector.

Where to go from here

For an example of an AWS use case where compliance violations are identified, see Walkthough: Identifying AWS compliance violations.

To learn more about all the options available in Cloud Security for working with connectors, see Managing connectors.

^{_{Back to top}}

Certificate Manager	Yes
CloudFront	Yes
CloudTrail	Yes
CloudWatch	Yes
CloudWatch Events	Yes
Config	Yes
EC2-ELB	Yes
EC2-Instances	Yes
EC2-Other	Yes
Elasticsearch Service	Yes
IAM	Yes
Key Management Service	Yes
Relational Database Service	Yes
S3	Yes
SNS	Yes
VPC	Yes
WAF	Yes

Walkthrough: Onboarding the AWS Cloud connector

Where to go from here

Comments