Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
AWS Organizations - AskJ1 Community
<main> <article class="userContent"> <p>JupiterOne supports the ingestion of multiple AWS accounts that AWS Organizations manages by configuring a single integration on the AWS management account of the Organization.</p> <p>When you create an AWS configuration in the <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/1181-aws-integration-with-jupiterone">J1 AWS Integrations UI</a>, in the Configure Organization Accounts section, select to auto-configure additional integrations for organization accounts.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/UBIH280TX9S0/aws-organizations-configure-checkbox.png" alt="aws-organizations-configure-checkbox" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="obtaining-the-aws-role-arn">Obtaining the AWS Role ARN</h2> <p>When you create an AWS configuration, you must provide an AWS role Amazon Resource Name (ARN) to uniquely identify AWS resources for J1. You obtain the role ARN from the JupiterOne Integration role that is created in your main AWS account</p> <p>Select one of the four options for obtaining the role ARN that is most suitable for your devops process:</p> <ul><li>CloudFormation</li> <li>AWS Management Console</li> <li>AWS CLI</li> <li>Terraform</li> </ul><p><strong>Note</strong>: J1 recommends that you keep the configuration creation window open in the J1 UI while you use another window to obtain your role ARN to be able to transfer and confirm information between J1 and the option you use to obtain your role ARN.</p> <h3 data-id="using-cloudformation">Using CloudFormation</h3> <p>To use CloudFormation:</p> <ol><li><p>Go to the CloudFormation <a rel="nofollow" href="https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=jupiterone-integration&templateURL=https%3A%2F%2Fs3.amazonaws.com%2Fjupiterone-prod-us-jupiter-aws-integration%2Fiam-cloudformation.json">Quick create stack page</a>.</p></li> <li><p>Enter a name for the stack.</p></li> <li><p>In the JupiterOne Authentication Parameters section of the stack page, enter your J1 AWS account ID.</p></li> <li><p>Go to your J1 Configuration Settings page, and copy your External ID.</p></li> <li><p>Go back to the CloudFormation page and paste your J1 External ID in the second field of the JupiterOne Authentication Parameters section.</p></li> <li><p>Continue going through each page, providing stackset and deployment options according to your requirements.</p></li> <li><p>Select the acknowledge box in the Capabilities section, and click <strong>Create stack</strong>.</p> <p>The new CloudFormation stack then creates a role in your AWS account and returns an role ARN of the role in the Outputs section.<br> </p> <p><img src="https://us.v-cdn.net/6035534/uploads/6YSCA2C9KV8J/integration-cloudformation-creation.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p></p></li> <li><p>Copy the <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">RoleARN</code> value and paste it in the Role ARN field on the J1 Configuration Settings page.</p> <p>It should look similar to:</p> <p><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">arn:aws:iam:: <your_aws_account_number>:role/JupiterOneIntegration-JupiterOneRole-<random_value></code></p></li> <li><p>You can now complete the Create Configuration task to finish creating your J1 AWS integration.</p></li> </ol><p>Under the stack instance in CloudFormation, you can see the list of AWS accounts.</p> <h3 data-id="using-terraform">Using Terraform</h3> <p>The first step is to ensure that each AWS account in the AWS Organization is configured with the same JupiterOne IAM role, policies, and external trust ID. If you are using Terraform in your AWS environment, there are setup instructions in J1 Integrations under the AWS Setup Instructions.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/OPM0FE66Z9MR/aws-organizations-terraform-setup.png" alt="aws-organizations-terraform-setup" class="embedImage-img importedEmbed-img"></img></p> <p>For more detailed instructions, see <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/984-aws-faqs">How can I add/configure all the sub-accounts in my AWS Organization?</a> <br> in the AWS Specific Questions article. After all sub-accounts are configured correctly in AWS, if you select the <strong>Configure Organization Accounts</strong> option, J1 pulls in data for each sub-account into your J1 account.</p> <p>You can now complete the Create Configuration task to finish creating your J1 AWS integration.</p> <p>To exclude an AWS account, you can assign the tag <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">j1-integration:SKIP</code> to that specific account within AWS Organizations. See the question <a rel="nofollow" href="https://jupiterone.vanillacommunities.com/kb/articles/984-aws-faqs">How can I skip certain sub-accounts when auto-configuring my AWS Organization?</a></p> <h3 data-id="account-email-address-property">Account Email Address Property</h3> <p>The CIS Benchmark requires that you associate a contact email address with an AWS account in the event of a breach or security compromise. The <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">email</code> property for an <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_account</code> is only ingested when an AWS integration configuration for the management account has the option selected to enable auto-configuration of AWS organization accounts.</p> <p>If an incorrect/unexpected email address is associated with an AWS account, refer to the following AWS article: <a rel="nofollow" href="https://aws.amazon.com/premiumsupport/knowledge-center/change-email-address/">How do I change the email address that's associated with my AWS account?</a></p> <h2 data-id="management-account">Management Account</h2> <p>After creating the configuration for the organization, you see confirmation of a successful integration of the management account for the JupiterOne AWS integration in the list of configurations. The management account shows how many assets it has in the system.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/TSJ08Q6K3UD1/integration-confirmation.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>J1 automatically ingests and configures all the AWS member accounts that are managed by the management account using the CloudFormation stackset</p> <p><img src="https://us.v-cdn.net/6035534/uploads/YS9J1JWX8HOY/integration-children.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>The member accounts in J1 should match those in your AWS Organization hierarchy.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/XKDACRQU8VIN/integration-children-aws.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="properties">Properties</h2> <p>The following properties are created on the management account and member accounts:</p> <table><thead><tr><th>Properties</th> </tr></thead><tbody><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">accountId</code>: The unique identifier (ID) of the account</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">active</code>: True or false value if the status is equal to active</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">arn</code>: The Amazon Resource Name (ARN) of the account</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">displayName</code>: The friendly name of the account (multiple values)</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">email</code>: The email address associated with the AWS account</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">id</code>: The unique identifier (ID) of the account</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">joinedMethod</code>: The method by which the account joined the organization</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">joinedOn</code>: The date the account became a part of the organization</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">name</code>: The friendly name of the account</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">orgAccountArn</code>: The ARN of this account within the Organization</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">orgAccountName</code>: The name of this account as seen in the Organizations UI</td> </tr><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">status</code>: The status of the account in the organization</td> </tr></tbody></table><h2 data-id="relationships">Relationships</h2> <p>The following relationships are mapped:</p> <table><thead><tr><th>Relationships</th> </tr></thead><tbody><tr><td><code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_account</code> (management account) <strong>HAS</strong> <code class="code codeInline code codeInline" spellcheck="false" tabindex="0">aws_account</code> (member account)</td> </tr></tbody></table> </article> </main>
.png)