Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
AWS GovCloud - AskJ1 Community
<main> <article class="userContent"> <h2 data-id="integration-walkthrough">Integration Walkthrough</h2> <p>The integration instance configuration requires the <code class="code codeInline" spellcheck="false" tabindex="0">accessKeyId</code> of the<br> customer's IAM user to create credentials used to read infrastructure<br> information through AWS APIs. The instance configuraiton also requires the<br><code class="code codeInline" spellcheck="false" tabindex="0">secretAccessKey</code> that is associated with the <code class="code codeInline" spellcheck="false" tabindex="0">accessKeyId</code>.</p> <h3 data-id="in-aws">In AWS</h3> <h4 data-id="step-1-create-iam-policy">Step 1: Create IAM Policy</h4> <ol><li><p>From the AWS GovCloud Console homepage, search and select <strong>IAM</strong> under<br> Services.</p></li> <li><p>Select <strong>Policies</strong></p></li> <li><p>Click <strong>Create Policy</strong>, select the <strong>JSON</strong> tab, and enter the following<br> document content:</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Resource": "*", "Action": [ "access-analyzer:List*", "batch:Describe*", "batch:List*", "cloudhsm:DescribeBackups", "cloudhsm:DescribeClusters", "cloudhsm:ListTags", "cloudwatch:GetMetricData", "cloudwatch:List*", "dynamodb:Describe*", "dynamodb:List*", "ec2:GetEbsDefaultKmsKeyId", "ec2:GetEbsEncryptionByDefault", "ecr:Describe*", "ecr:GetLifecyclePolicy", "ecr:GetRepositoryPolicy", "ecr:List*", "elasticache:List*", "elasticfilesystem:Describe*", "elasticmapreduce:List*", "es:List*", "kinesis:Describe*", "kinesis:List*", "lambda:GetFunction", "macie2:GetFindings", "macie2:ListFindings", "s3:GetObjectRetention", "s3:GetObjectLegalHold", "s3:Get*Configuration", "shield:GetSubscriptionState", "sns:GetTopicAttributes", "sns:GetSubscriptionAttributes", "sns:ListTopics", "sns:ListSubscriptions", "sns:ListTagsForResource", "waf:List*", "waf:Get*", "waf-regional:List*", "waf-regional:Get*", "workspaces:List*" ] }, { "Effect": "Allow", "Action": ["apigateway:GET"], "Resource": ["arn:aws:apigateway:*::/*"] } ] } </pre></li> <li><p>Click <strong>Tags</strong> then <strong>Review</strong> and verify the permissions.</p></li> <li><p>Enter <code class="code codeInline" spellcheck="false" tabindex="0">{{productNameNoSpaces}}SecurityAudit</code> as the <strong>Name</strong> and click<br><strong>Create Policy</strong>.</p></li> </ol><h4 data-id="step-2-create-iam-user">Step 2: Create IAM User</h4> <ol><li><p>Navigate to the <strong>Users</strong> page and select user you are using</p></li> <li><p>Select <strong>Add users</strong></p></li> <li><p>Enter <code class="code codeInline" spellcheck="false" tabindex="0">{{productNameNoSpaces}}User</code> as the <strong>user name</strong> for the new user</p></li> <li><p>Select <strong>Access key - Programmatic access</strong> under <strong>Select AWS credential<br> type</strong></p></li> <li><p>Select <strong>Next: Permissions</strong></p></li> <li><p>Select the <strong>Attach existing policies directly</strong> tab</p></li> <li><p>In the Policy search box, search for <code class="code codeInline" spellcheck="false" tabindex="0">SecurityAudit</code>. Select both<br><code class="code codeInline" spellcheck="false" tabindex="0">SecurityAudit</code> and <code class="code codeInline" spellcheck="false" tabindex="0">{{productNameNoSpaces}}SecurityAudit</code> policies.<br><code class="code codeInline" spellcheck="false" tabindex="0">SecurityAudit</code> is an AWS-managed IAM policy that grants access to read<br> security configurations of AWS resources.</p></li> <li><p>Click <strong>Tags</strong> then <strong>Review</strong> and verify user information is correct</p></li> <li><p>Click <strong>Create User</strong></p></li> <li><p>Copy both the <strong>AccessKeyId</strong> and <strong>SecretAccessKey</strong> (click show to<br> display) from the final screen. These values are needed for JupiterOne<br> Configuration</p></li> </ol><h3 data-id="in-jupiterone">In JupiterOne</h3> <ol><li>From the top navigation of the J1 Search homepage, select <strong>Integrations</strong>.</li> <li>Scroll to the <strong>AWS GovCloud</strong> integration tile and click it.</li> <li>Click the <strong>Add Configuration</strong> button and configure the following settings:</li> </ol><ul><li><p>Enter the <strong>Account Name</strong> by which you'd like to identify this AWS account in<br> JupiterOne. Ingested entities will have this value stored in <code class="code codeInline" spellcheck="false" tabindex="0">tag.AccountName</code><br> when <strong>Tag with Account Name</strong> is checked.</p></li> <li><p>Enter a <strong>Description</strong> that will further assist your team when identifying<br> the integration instance.</p></li> <li><p>Select a <strong>Polling Interval</strong> that you feel is sufficient for your monitoring<br> needs. You may leave this as <code class="code codeInline" spellcheck="false" tabindex="0">DISABLED</code> and manually execute the integration.</p></li> <li><p>Enter the <strong>Account ID</strong> of the GovCloud account you are ingesting data from.</p></li> <li><p>Enter the <strong>Access Key ID</strong> of the IAM user to create credentials in order to<br> authenticate with AWS.</p></li> <li><p>Enter the <strong>Secret Access Key</strong> associated with Access Key Id.</p></li> </ul><ol start="4"><li>Click <strong>Create Configuration</strong> once all values are provided.</li> </ol> </article> </main>
.png)