AWS Platform Requirements

Overview

Before you add an AWS account as a device in TOS, you need to configure IAM identities and permissions on the AWS platform.

The exact configuration on AWS depends on which onboarding model you use:

• Single-account onboarding: One AWS account at a time, using access keys for an IAM user in that account.

• Cross-account onboarding: Multiple AWS accounts, using a management account and a single IAM user that assumes a role in each target account.

• AWS Organizations onboarding: Member accounts discovered automatically through AWS Organizations, using a management account and an IAM user that assumes an identically-named role in each member account.

See Management account configuration and Member/target account configuration.

Regardless of the onboarding model, you also need to configure permissions in AWS based on the TOS functionality and features to use. See Permission blocks for target accounts.

After configuring AWS, you can add the device to TOS, edit the configuration settings, import AWS resources, and migrate domains.

Management account configuration (cross-account and AWS Organizations)

Use this configuration for cross-account and organization-based onboarding through a management account.

Management account IAM user

Create a dedicated IAM user in the management account with programmatic access (Access Key ID and Secret Access Key).

The management-account IAM user:

• Authenticates to AWS using the access keys.

• Uses AWS STS to assume a standardized role in each target account and obtain temporary credentials.

Account authentication permissions

For TOS to authenticate with and monitor the AWS account, you need the account credentials, and permissions set in AWS.

IAM policies for management-account IAM user

• STS AssumeRole: Permission to call sts:AssumeRole on the target role in each target account.

Permissions for discovery/import of AWS Organizations

For AWS Organization-based onboarding, create permissions that allow TOS to read the organization structure, such as organization details, organization units (OUs), and accounts.

Member/target account configuration (all onboarding models)

Each AWS account that TOS monitors is a target account. Regardless of the onboarding model, you require permissions for the target account—either attached to an IAM user for single-account onboarding, or to an IAM role for cross-account/organization-based onboarding.

Target-account IAM user (single-account onboarding)

For single-account onboarding, create an IAM user in the target account with programmatic access and attach the required permission policies as listed in Permission blocks for target accounts.

Target account IAM role (cross-account and AWS Organization onboarding)

For cross-account and Organization-based onboarding, create an IAM role in each target account.

This role must include:

• Trust policy defining who can assume the role. Allow the management account to assume the role.

• Permissions policy defining what TOS can do. Attach the required permission policies for TOS to retrieve configuration and flow information for monitoring and discovery.

• Amazon Resource Name (ARN) identifier to use the AssumeRole option for cross-account monitoring. For more information, see Amazon AWS AssumeRole Support.

Permission blocks for target accounts

Use the following permission blocks based on the features you want to enable.

Related topics

SecureTrack features for AWS

SecureChange features for AWS