AWS Integration

An Amazon Web Services (AWS) integration with Cloudhouse Guardian (Guardian) allows you to automatically sync and detect nodes from your AWS instance(s) to be added to Guardian for monitoring and evaluation. This topic describes the steps you need to complete to setup an AWS integration to Guardian.

Dependencies

To add an AWS integration, you need the following:

• An AWS account.

• One or more of the following services enabled within your AWS instance:

  • Auto Scaling Groups.

  • CloudFormation.

  • CloudTrails.

  • CloudWatch.

  • Config Services.

  • EBS Volumes.

  • EC2 Instances.

  • Access Analyzer.

  • IAM Access Analyzers.

  • IAM Account.

  • Key Management Services.

  • Lambda Functions.

  • Load Balancers.

  • Load Balancers V2.

  • RDS Instances.

  • S3 Buckets.

  • Security Groups.

  • VPCs.

  • VPC Flow Logs.

  • VPC Subnets.

• Security Group Permissions – Required for each of the above service(s) you plan to add to Guardian for monitoring. For more information, see Security Group Permissions.

Add an AWS Integration

Integrating AWS with Guardian establishes a seamless connection to streamline the process of syncing and monitoring your AWS nodes, ensuring they are efficiently scanned in Guardian.

To add an AWS integration to Guardian, complete the following:

1. In the Guardian web application, navigate to the Integrations tab (Control > Integrations) and click Add Integration. The Add Integration page is displayed.

   

2. Select AWS from the list of available integrations. Here, you are required to complete the following options:

   

   Option	Description
   Name field	The display name for the integration within Guardian. This name is how you will identify the integration among all others configured in your Guardian instance, so ensure it is descriptive.
   Connection Manager Group drop-down list	The Connection Manager group that is responsible for scanning and retrieving your AWS node(s). Select a Connection Manager group from the drop-down list.
   AWS Access Key field	The unique IAM account identifier. For more information on how to source this, see AWS Scan User Account.
   AWS Secret Key field	The secret access key that is required to sign the request. For more information on how to source this, see AWS Scan User Account.
   AWS IAM Role ARN (Optional) field	The Amazon resource name that specifies the role of the IAM account holder. For more information on how to source this, see AWS Scan User Account.
   AWS Regions (Optional) field	The region your AWS account is using. This is displayed in your AWS Console login URL. For example, 'https://console.aws.amazon.com/console/home?region=us-west-1'.
   Enable Multi-Account Detection field	Option to enable multi-account detection. If selected, discovery across multiple accounts using one set of credentials is enabled. For more information on how to source this, contact your Cloudhouse Representative.
   Check Things You Want To Detect checkboxes	The option(s) you want to add to Guardian for monitoring. Select the checkbox(es) you want to detect. For example, ‘Auto Scaling Groups’. Selecting a checkbox displays the following detection options: Ignore [Node Type] Nodes – Option to ignore specific nodes from scans. Enter regular expression (RegEx) tags in the [Node Type] Ignore Tags field. Nodes containing these tags will not be included during scans. Note: The Negate [Node Type] Ignore Tags checkbox reverses the detection rules you've set. If selected, the nodes containing the tags you entered will be the only ones included for detection. Remove [Node Type] Nodes – Option to remove specific nodes when they are no longer detected. Enter RegEx tags in the [Node Type] Remove Tags field. Nodes containing these tags will be removed if they are not detected during a scan. Note: The Negate [Node Type] Remove Tags checkbox reverses the detection rules you've set. If selected, the nodes that don't contain the tags you entered will be removed and the only nodes included for detection will be the ones that contain the tags. Allow Existing [Node Type] Nodes to Be Removed – Option to change the standard behavior of ignoring nodes with tags. Normally, if a node is ignored due to the tags, nodes can't be removed. However, selecting the Allow Existing [Node Type] Nodes to Be Removed checkbox lets you remove previously ignored nodes later when they are no longer detected, despite the ignore detection rule. Tip: The Allow Existing [Node Type] Nodes to Be Removed checkbox was removed in V4.3.51.0 of Guardian. For more information, see January 2025 Quarterly Release. Note: If the EC2 Instances checkbox is selected from the list of Check Things You Want To Detect checkboxes, additional fields are displayed to allow you to configure what aspects of the EC2 instance to import to Guardian. For more information on how to configure these settings, see EC2 Instances.
   Ignore Ephemeral Nodes checkbox	Option to ignore ephemeral nodes. If selected, ephemeral nodes are not imported and not included in node scans.
   Remove Ephemeral Nodes checkbox	Option to remove ephemeral nodes. If selected, ephemeral nodes are removed from the Guardian import list.
   Automatically start monitoring and scanning newly detected nodes checkbox	Option to automatically start monitoring and scanning your nodes once the AWS integration has been created. If selected, the imported nodes are automatically added to the Monitored tab (Inventory > Monitored) for regular scanning. Here, you can apply policies, create node groups, and schedule regular scans. For more information, see Monitored Nodes. If not selected, the nodes are added to the Detected tab (Inventory > Detected) for processing. To monitor the detected nodes, you must move them to the Monitored tab. For more information, see Detected Nodes.

3. Once you have set the correct values for each of the options displayed, click Done to create the AWS integration.

If successful, a confirmation message is displayed and the AWS integration is added to the Integrations tab of your Guardian instance. If unsuccessful, an error message is displayed. Use the information displayed in the error message(s) to troubleshoot the values in your AWS Integration options.

Integration Outcomes

When integrating AWS with Guardian, the following outcomes are expected:

• The integration stores the credentials that you supply to Guardian securely, within the database.

• An automatic synchronization (between Guardian and AWS) occurs every two hours. For more information on how to alter this interval, see Job Schedule (Control > Job Schedule).

• The sync event calls out to AWS using the supplied credentials to return a list of detected nodes and their corresponding details.

• By default, any nodes that Guardian detects within your AWS instance are automatically stored within the Detected tab for processing.

• Alternatively, if the Automatically start monitoring and scanning newly detected nodes checkbox is selected, the detected nodes are added to the Monitored tab instead.

Troubleshooting

If you are experiencing issues with your integration, try the following:

• Verify that the account credentials supplied for the integration are correct.

• Depending on how the integration was configured, the synced nodes are either displayed on the Detected tab or the Monitored tab.

• To confirm the status of the integration sync, check the integration sync event in the Events tab (Control > Events) of your Guardian instance. For more information, see Events.

Security Group Permissions

When setting up an AWS integration, the following security group permissions are required, in order to sync and scan nodes from the corresponding service(s):

autoscaling:DescribeAutoScalingGroups

cloudformation:DescribeStacks

cloudformation:GetTemplate

cloudformation:GetTemplateSummary

cloudformation:ListStackInstances

cloudformation:ListStacks

cloudformation:ListStackSets

cloudtrail:DescribeTrails

cloudtrail:GetEventSelectors

cloudtrail:GetTrailStatus

cloudtrail:ListPublicKeys

cloudtrail:ListTrails

s3:GetBucketLogging

s3:GetBucketPolicy

cloudwatch:DescribeAlarms

cloudwatch:ListDashboards

cloudwatch:ListTagsForResource

events:ListEventBuses

events:ListRules

logs:DescribeLogGroups

config:DescribeConfigurationRecorders

ec2:DescribeVolumes

ec2:DescribeInstances

ec2:DescribeRouteTables

ec2:DescribeSubnets

access-analyzer:ListAnalyzers

access-analyzer:ListPolicyGenerations

access-analyzer:ListTagsForResource

iam:GenerateCredentialReport

iam:GetAccessKeyLastUsed

iam:GetAccountPasswordPolicy

iam:GetAccountSummary

iam:GetCredentialReport

iam:GetGroupPolicy

iam:GetPolicyVersion

iam:GetRolePolicy

iam:GetUserPolicy

iam:ListAccessKeys

iam:ListAttachedGroupPolicies

iam:ListAttachedRolePolicies

iam:ListAttachedUserPolicies

iam:ListGroupPolicies

iam:ListGroups

iam:ListGroupsForUser

iam:ListMFADevices

iam:ListPolicies

iam:ListRolePolicies

iam:ListRoles

iam:ListServerCertificates

iam:ListUserPolicies

iam:ListUsers

iam:ListUserTags

iam:ListVirtualMFADevices

kms:DescribeKey

kms:GetKeyRotationStatus

kms:ListAliases

kms:ListResourceTags

lambda:GetFunction

lambda:GetPolicy

lambda:ListFunctionEventInvokeConfigs

lambda:ListProvisionedConcurrencyConfigs

lambda:ListTags

elasticloadbalancing:DescribeListeners

elasticloadbalancing:DescribeLoadBalancers	

elasticloadbalancing:DescribeLoadBalancerAttributes

elasticloadbalancing:DescribeLoadBalancerPolicies

elasticloadbalancing:DescribeLoadBalancerPolicyTypes

elasticloadbalancing:DescribeSSLPolicies

elasticloadbalancing:DescribeTags

elasticloadbalancing:DescribeListeners

elasticloadbalancing:DescribeLoadBalancers

elasticloadbalancing:DescribeLoadBalancerAttributes

elasticloadbalancing:DescribeLoadBalancerPolicies

elasticloadbalancing:DescribeLoadBalancerPolicyTypes

elasticloadbalancing:DescribeSSLPolicies

elasticloadbalancing:DescribeTags

rds:DescribeDBInstances

rds:ListTagsForResource

s3:GetBucketAcl, s3:GetBucketCORS

s3:GetBucketEncryption

s3:GetBucketEncryptionConfiguration

s3:GetBucketLocation

s3:GetBucketLogging

s3:GetBucketPolicy

s3:GetBucketPublicAccessBlock

s3:GetBucketReplication

s3:GetBucketTagging

s3:GetBucketVersioning

s3:GetObjectAcl

s3:ListAllMyBuckets

ec2:DescribeSecurityGroups

ec2:DescribeNetworkAcls

ec2:DescribeVpcAttribute

ec2:DescribeVpcs

ec2:DescribeFlowLogs

ec2:DescribeSubnets