Amazon Web Services (AWS)

Amazon Web Services (AWS) adapter includes a broad set of global cloud-based products. It supports EC2, ECS, EKS, IAM, EBS, ELB, RDS, S3, VPC, Workspaces, Lambda, Route 53 and more.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices
• Users
  
  

Parameters

To connect Axonius to your AWS resources, you will need to create an IAM user, assemble the required credentials (Access key id & Secret access key) and configure your account/accounts if necessary.

1. Region Name or Get All Regions (optional, default: empty) - Specify the region name for a specific region or If you would like Axonius to try connecting to all regions, select the "Get All Regions" option.
2. AWS Access Key ID (optional, default: empty) - Provide AWS Access Key ID or choose to use EC2 instance attached IAM role.
3. AWS Access Key Secret (optional, default: empty) - Provide AWS Access Key Secret or choose to use EC2 instance attached IAM role.
4. Account Tag (optional, default: empty) - Tag for the EC2 instance ("nickname").
5. Proxy (optional, default: empty) - HTTPS proxy to use when connecting to the AWS APIs.
   • If supplied, Axonius will utilize the proxy when connecting to the AWS APIs.
   • If not supplied, Axonius will connect directly to the AWS APIs.
6. Roles to assume (optional, default: empty) – A file with role-ARNs which the AWS Adapter will try to assume for cross-account access with the single IAM user. Two available formats:
   • List of comma-delimited role-ARNs

   arn:aws:iam::111111111111:role/axonius-role, arn:aws:iam::222222222222:role/axonius-role
   

   • JSON format - list of dictionaries that define each role.
     • external_id is only supported in the Json format
     • The external_id can be different for every role in the list.

   [
       {"arn": "arn:aws:iam::111111111111:role/axonius-role"},
       {"arn": "arn:aws:iam::222222222222:role/axonius-role", "external_id": "MY-SECRET"}
   ]
   

7. Use attached IAM role (optional, default: empty) - Select to use the EC2 instance (Axonius installed on) attached IAM role / instance profile instead of using the AWS Access Key ID and AWS Access Key Secret credentials supplied. This does not affect the Roles to assume parameter.
8. Advanced Configuration File (optional, default: empty) - Upload an advanced configuration JSON file. For details, see Advanced Configuration File
9. For details on the common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Configuration File

The Advanced Configuration File field lets you upload an advanced configuration JSON file. The file can be empty ({}) or may conatin any combination of the following key/value pairs in a JSON format.

• If supplied, when connecting to the source, Axonius will consider the configuration in the uploaded file in addition to the values specified in the various fields of the connection for this adapter.
• If not supplied, when connecting to the source, Axonius will only consider the values specified in the various fields of the connection for this adapter.

Advanced Settings

The Amazon Web Services (AWS) adapter has unique, advanced settings which enable configuring the logic around correlation of the AWS cloud servers (devices) and the information Axonius will fetch for each of them.

1. Correlate ECS containers with their EC2 Instance (required, default: False) - Select whether to correlate ECS containers with the EC2 host they are running on.
   • If enabled, all connections for this adapter will correlate ECS containers with the EC2 host they are running on.
   • If disabled, all connections for this adapter will not correlate ECS containers with the EC2 host they are running on. Such ECS and EC2 will be created in Axonius as two different devices.
2. Correlate EKS containers with their EC2 Instance (required, default: False) - Select whether to correlate EKS containers with the EC2 host they are running on.
   • If enabled, all connections for this adapter will correlate EKS containers with the EC2 host they are running on.
   • If disabled, all connections for this adapter will not correlate EKS containers with the EC2 host they are running on. Such EKS and EC2 will be created in Axonius as two different devices.
3. Fetch information about EC2 attached roles (required, default: False) - Select whether to fetch information about each EC2 attached roles.
   • If enabled, all connections for this adapter will fetch information about each EC2 attached roles from AWS.
   • If disabled, all connections for this adapter will not fetch any information about each EC2 attached roles from AWS.
4. Fetch information about ELB (Elastic Load Balancers) (required, default: False) - Select whether to fetch information about all available load balancers and add that information to relevant EC2 instances.
   • If enabled, all connections for this adapter will fetch information about all available load balancers and add that information to relevant EC2 instances. Each ELB will be represented then as a separate device.
   • If disabled, all connections for this adapter will not fetch any information about all load balancers.
5. Fetch information about SSM (System Manager) (required, default: False) - Select whether to fetch additional information from AWS SSM for each host.
   • If enabled, all connections for this adapter will fetch additional information from AWS SSM for each host.
   • If disabled, all connections for this adapter will not fetch any information about AWS SSM.
6. Fetch information about NAT Gateways (required, default: False) - Select whether to fetch NAT gateways as devices assets.
   • If enabled, all connections for this adapter will fetch all available NAT gateways data from AWS.
   • If disabled, all connections for this adapter will not fetch any NAT gateways data from AWS.
7. Fetch internet gateways as devices (required, default: False) - Select whether to fetch internet gateways as devices assets.
   • If enabled, all connections for this adapter will fetch all available internet gateways data from AWS. Each internet gateway will be added as a unique device.
   • If disabled, all connections for this adapter will not fetch any internet gateways data from AWS.
8. Fetch route tables as devices (required, default: False) - Select whether to route tables as devices assets.
   • If enabled, all connections for this adapter will fetch all available route tables data from AWS. Each route table will be added as a unique device.
   • If disabled, all connections for this adapter will not fetch any route tables data from AWS.
9. Add route tables to devices (required, default: False) - Select whether to fetch information about route tables and add it to the appropriate devices.
   • If enabled, all connections for this adapter will fetch all route tables data from AWS for the following services:
     • EC2
     • ELB
     • IGW
     • NAT
     • RDS
     • Workspaces
     • ECS - only if Correlate ECS Containers with their EC2 Instance checkbox is enabled.
     • EKS - only if Correlate EKS Containers with their EC2 Instance checkbox is enabled.
   • If disabled, all connections for this adapter will not fetch any route tables data from AWS.
10. Fetch information about Elasticsearch (required, default: False) - Select whether to fetch information on the existing Elasticsearch instances.
    • If enabled, all connections for this adapter will fetch all existing Elasticsearch instances data from AWS.
    • If disabled, all connections for this adapter will not fetch any Elasticsearch instances data from AWS.
11. Fetch ELB IP using current DNS (required, default: False) - Select whether to resolve the IP address of each ELB using the current DNS server.
    • If enabled, all connections for this adapter will resolve the IP address of each ELB using the current DNS server.
    • If disabled, all connections for this adapter will not resolve the IP address of each ELB.
      NOTE

      This setting will take affect only if the Fetch information about ELB (Elastic Load Balancers) checkbox is enabled.

12. Fetch information about RDS (Relational Database Service) (required, default: False) - Select whether to fetch the information on the existing Amazon RDS instances.
    • If enabled, all connections for this adapter will fetch all existing Amazon RDS instances data from AWS.
    • If disabled, all connections for this adapter will not fetch any Amazon RDS instances data from AWS.
13. Fetch information about S3 (required, default: False) - Select whether to fetch information about Amazon S3 buckets, such as their ACL's, locations and their public status.
    • If enabled, all connections for this adapter will fetch information about Amazon S3 buckets data from AWS.
    • If disabled, all connections for this adapter will not fetch any Amazon S3 buckets data from AWS.
    • When using the Cloud Asset Compliance, this settings is required to view Affected Devices of type S3 buckets.
14. Fetch information about IAM Users (required, default: False) - Select whether to fetch information about IAM users, attached groups, attached policies and access keys.
    • If enabled, all connections for this adapter will fetch information about IAM users, attached groups, attached policies and access keys.
    • If disabled, all connections for this adapter will not fetch any information about IAM users from AWS.
    • When using the Cloud Asset Compliance, this settings is required to view Affected Devices of type IAM Users.
15. Fetch IAM roles as users (required, default: False) - Select whether to add IAM roles as users assets.
    • If enabled, all connections for this adapter will fetch IAM roles from AWS. Each IAM roles will be added as a unique user.
    • If disabled, all connections for this adapter will not fetch IAM roles from AWS.
16. Fetch VPCs as devices (required, default: False) - Select whether to add VPCs as devices assets.
    • If enabled, all connections for this adapter will fetch VPCs from AWS. Each VPC will be added as a unique device.
    • If disabled, all connections for this adapter will not fetch VPCs from AWS.
17. Parse IAM policies (required, default: False) - Select whether to fetch information about the privileges that are granted to each AWS IAM user by group, inline and attached IAM policies.
    • If enabled, all connections for this adapter will query each AWS IAM user to determine the privileges that are granted to it by group, inline and attached IAM policies.
    • If disabled, all connections for this adapter will not fetch information about the privileges that are granted to each AWS IAM user.
18. Fetch IAM Users' AWS Services (required, default: False) - Select whether to fetch the AWS Services accessed by an IAM User.
    • If enabled, all connections for this adapter will fetch the AWS Services accessed by an IAM User.
    • If disabled, all connections for this adapter will not fetch the AWS Services accessed by an IAM User.
19. Fetch information about Workspaces (required, default: False) - Select whether to fetch information about Amazon Workspaces.
    • If enabled, all connections for this adapter will fetch Amazon Workspaces data from AWS.
    • If disabled, all connections for this adapter will not fetch any Amazon Workspaces data from AWS.
20. Fetch information about Lambdas (required, default: False) - Select whether to fetch information on AWS Lambdas.
    • If enabled, all connections for this adapter will fetch AWS Lambdas data from AWS.
    • If disabled, all connections for this adapter will not fetch any AWS Lambdas data from AWS.
21. Fetch information about Route 53 (required, default: False) - Select whether to fetch information on Amazon Route 53 DNS records.
    • If enabled, all connections for this adapter will fetch Amazon Route 53 DNS records from AWS.
    • If disabled, all connections for this adapter will not fetch any Amazon Route 53 DNS records from AWS.
22. Fetch information about Cloudfront (required, default: False) - Select whether to fetch information on Cloudfront.
    • If enabled, all connections for this adapter will fetch Cloudfront information from AWS.
    • If disabled, all connections for this adapter will not fetch Cloudfront information from AWS.
23. Add WAF to devices (required, default: False) - Select whether to enrich devices with WAF information. WAF (WebAcl) versions 1 and 2 for regional and Cloudfront devices.
    • If enabled, all connections for this adapter will enrich relevant devices with WAF information.
    • If disabled, all connections for this adapter will enrich devices with WAF information.
24. Fetch Organizations as devices (required, default: False) - Select whether to add Organizations data as devices assets.
    • If enabled, all connections for this adapter will fetch Organizations data from AWS. Each Organization will be added as a unique device.
    • If disabled, all connections for this adapter will not fetch Organizations data from AWS.
25. Show verbose notifications about connection failures (required, default: False) - Select whether to create a system notification with all failed AWS connections on each discovery cycle.
    • If enabled, all connections for this adapter will create a system notification with all failed AWS connections on each discovery cycle.
    • If disabled, all connections for this adapter will not create a system notification with all failed AWS connections on each discovery cycle.
26. Shodan API key for more IP info (optional, default: empty) – Specify an API key which will be used to query information about public IP addresses.
27. Verify all IAM roles (required, default: True) - Select whether to verify all IAM roles.
    • If enabled, all connections for this adapter will verify all IAM roles. If one of the IAM roles is not valid, the adapter connection will fail.
    • If disabled, all connections for this adapter will not verify all IAM roles. Only if all the IAM roles are not valid, the adapter connection will fail.
28. Verify primary account permissions (required, default: True) - Whether or not the primary account permissions should be used when the adapter connections fetch data from AWS.
    • If enabled, all connections for this adapter will use the primary account permissions to fetch data from AWS. If the primary account permissions are insufficient, the adapter connections will fail to fetch the data.
    • If disabled, all connections for this adapter will only use the primary account to assume the roles attached to it, and the adapter connections will use those role permissions to fetch data from AWS. This setting should be disabled only if you want to use the primary account assumed roles permissions instead of the primary account permissions when fetching assets from AWS.
29. Do not fetch EC2 machines that are turned off (required, default: False) - Whether or not to fetch EC2 devices that their power state is turned off.
    • If enabled, all connections for this adapter will only fetch EC2 devices which their power state is turned on.
    • If disabled, all connections for this adapter will fetch all EC2 devices, regardless of their power state.
30. Number of accounts to fetch in parallel (required, default: 5) - For all connections for this adapter, specify the number of AWS accounts Axonius will fetch data from in parallel.
31. List of tags to parse as fields (optional, default: empty) - Specify a comma-separated list of tag keys to be parsed as devices fields. Each tag is a key-value pair that is part of the Adapter Tags complex field.
    • If supplied, all connections for this adapter will parse any of the listed tags that are associated with the fetched device as:
      • Values of the Adapter Tags field.
      • Designated field with the name of the tag key and the value of the tag value.
    • If not supplied, all connections for this adapter will only parse all tags as values of the Adapter Tags field.

Connecting the Amazon Web Services (AWS) Adapter

To connect this adapter, you will first need to create an IAM user:

1. Open your AWS Dashboard and go to the IAM service.

2. Go to the "Policies" tab and click "Create policy". You will need to create a policy that grants read-only access to specific AWS Resources.

3. Click JSON and copy-paste the following JSON, which provides Axonius read-only access to the EC2, ECS, EKS, IAM, SSM, RDS,S3, Workspaces and Lambda services

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "iam:GenerateServiceLastAccessedDetails",
                "iam:Get*",
                "iam:List*",
                "iam:GenerateCredentialReport",
                "ecs:Describe*",
                "eks:Describe*",
                "eks:List*",
                "ecs:List*",
                "ec2:Get*",
                "es:List*",
                "elasticloadbalancing:Describe*",
                "ssm:Get*",
                "ssm:List*",
                "ssm:Describe*",
                "rds:List*",
                "rds:Describe*",
                "s3:List*",
                "s3:Get*",
                "cloudtrail:Get*",
                "cloudtrail:List*",
                "cloudtrail:Describe*",
                "cloudfront:List*",
                "cloudfront:Get*",
                "Workspaces:Describe*",
                "Workspaces:List*",
                "Lambda:Get*",
                "Lambda:List*",
                "apigateway:Get*",
                "route53:Get*",
                "route53:List*",
                "organizations:Describe*",
                "organizations:List*",
                "waf:GetWebACL",
                "waf:ListWebACLs",
                "waf-regional:GetWebACL",
                "waf-regional:GetWebACLForResource",    
                "waf-regional:ListWebACLs",
                "wafv2:GetWebACL*",
                "wafv2:GetWebACLForResource",
                "wafv2:ListWebACLs"
            ],
            "Resource": "*"
        }
    ]
}

4. Click "Review policy" and fill in the details. Then click "Create policy".

5. Next, click "Users" and then "Add User". Select "Programmatic access" to allow Axonius use the AWS API, and proceed to the permissions screen.

6. In the permissions screen, click "Attach existing policies directly", then attach the policy we just created.

7. Finally, click "Create User". You will see an access key ID and a secret access key you can show. Save both of them in a secure location (they will not appear again) for the adapter configuration.

8. At this point, you can use the credentials to access Axonius. Fill in all required fields in the adapter configuration, click save, and the AWS adapter is configured.

9. However, if you would like to use AWS EKS or AWS Roles, the configuration requires additional steps. Proceed to the next section to add permissions to your IAM User.

EKS Configuration

When an Amazon EKS cluster is created, the IAM entity (user or role) that creates the cluster is added to the Kubernetes RBAC authorization table as the administrator. Initially, only that IAM user can make calls to the Kubernetes API server using kubectl. Thus, you need to add our new IAM account to the kubectl configurations to get read-only permissions.

First, you need to get the ARN of the user we just created. In the IAM Service, click "Users" and select the new user we just created. Copy its User ARN.

1. You need to use kubctl, Kubernetes' admin command line interface to add a read-only group and map our AWS user to it. For each cluster you want Axonius to connect to, do the following steps.

As a logged-in admin, create a ClusterRoleBinding that maps the "view" ClusterRole to the group "axonius-readonly":

kubectl create clusterrolebinding axonius-view-cbr --clusterrole=view --group=axonius-readonly

2. Then, edit the Kubernetes AWS auth configurations, and add a new user mapping. If you don't have the mapUsers block already, create it.
   Open the editor to edit the configurations:

kubectl edit -n kube-system configmap/aws-auth

Then, append the new user mapping, while replacing the 'userarn' field with the ARN we got before.

mapUsers: |
    - userarn: arn:aws:iam::405799742499:user/Axonius-Readonly

      username: axonius-readonly

      groups:

        - axonius-readonly

The first part of the most basic configuration file should look similar to this:

3. Save the file.
4. You should see a message indicating your edit was successful.
   

Your IAM account can now authenticate against the Kubernetes cluster.

AWS Roles configuration

Axonius supports IAM Roles in the AWS adapter alongside the current IAM User for cross-account access, meaning that the AWS adapter can assume specified roles to allow fetching devices from other AWS accounts. To do this, you will have to create a role in the desired additional AWS account(s), and allow the IAM User which is being used in the adapter to assume this role. In each of your additional accounts:

1. Go to IAM and create the same policy created at steps 1-4.
2. Go to IAM -> Roles and create a new role. Choose "Another AWS Account". Fill in your primary account ID (the one in which the primary IAM user resides) and leave the other 2 options unchecked.

3. Click "Next" and select the read-only policy.

4. Click "Next" and fill in the details to create the role.

5. Now select the role you just created. Change the maximum session duration to 4 hours and click "Save changes".

6. Go to "Trust relationships" and click "Edit trust relationship". You will need to edit this trust relationship to allow only your specific IAM user to assume this. Change the 'AWS' parameter in the policy document to the IAM UserARN you created in the beginning of the guide. If you don't know it, log in to your primary account , go to IAM -> Users and click the IAM user to get its ARN.

7. Save the policy and keep the role ARN.

8. Do this for every additional account you want the AWS Adapter to connect to. After you are done, go back to your main account (the one with the IAM User you created). Go to IAM -> Policies to create a policy which allows your IAM User to assume the roles you created. Click "Create Policy" and switch to the JSON tab.

9. Paste the following JSON Policy and append your Role ARNs. In this example, we have 2 roles.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::405799742499:role/Axonius-Readonly-Role",
                "arn:aws:iam::405799742498:role/AxoniusDevRole"
            ]
        }
    ]
}

10. Click "Next" and give this policy a name, then create it.

11. Finally, go to IAM -> Users, select the user you created for Axonius and click "Add permissions". Attach the policy you created to allow this user to assume the roles. Attach the policy.

12. At this stage you can use Axonius to assume the roles you created. To assume these roles, create a file which contains all the role ARNS and use it in the adapter settings screen. Two available formats:
    • List of comma-delimited role-ARNs

    arn:aws:iam::405799742499:role/AxoniusDevRole, arn:aws:iam::405799742498:role/Axonius-Readonly-Role
    

    • JSON format - list of dictionaries that define each role.
      • external_id is only supported in the Json format
      • The external_id can be different for every role in the list.

    [
        {"arn": "arn:aws:iam::405799742499:role/AxoniusDevRole"},
        {"arn": "arn:aws:iam::405799742498:role/Axonius-Readonly-Role", "external_id": "MY-SECRET"}
    ]