AWS
Turn findings from AWS security services into risks and security signals, and copy CloudTrail events into the audit log.
At a glance
| Direction | Into Aegis. |
|---|---|
| What it brings in | Security Hub, Inspector, AWS Config (non-compliant resources) and IAM Access Analyzer findings; GuardDuty findings; CloudTrail events. |
| Where it lands | Security Hub, Inspector, Config and Access Analyzer findings become risks (Inspector with CVE links). GuardDuty findings go to the security signal inbox for review. CloudTrail events that matter for security are written to the audit log when you ask for it. |
| Credentials and permissions |
An access key of an IAM user (optionally assuming a role in another
account) with
securityhub:GetFindings,
inspector2:ListFindings,
config:DescribeComplianceByConfigRule,
config:DescribeConfigRules,
access-analyzer:ListAnalyzers,
access-analyzer:ListFindingsV2,
guardduty:ListDetectors,
guardduty:ListFindings,
guardduty:GetFindings,
cloudtrail:LookupEvents and
sts:GetCallerIdentity.
|
| Owner of imported records | Risks belong to the person who ran the sync. Signals have no owner until a reviewer accepts one. |
| When it runs | On demand, per service, from the connector page or the API. |
| Set it up |
/connectors/aws, by people allowed to configure
connectors, on a plan that includes the connector.
|
Good to know
- Each sync takes optional filters: severities, a maximum number of findings and the risk category for new risks.
- The secret access key is never shown again once saved.