This walkthrough will show the creation of the IAM Role in the source AWS account
configured in cross-account logging with a target account
It will also show the registration of the source AWS account in Oracle CASB Cloud Service
At this point in the configuration it is assumed that CloudTrail has already been enabled
and that it is sending its logs to a local S3 bucket on the target account
Log in to your source AWS account and navigate to Services
Under Security Identity and Compliance select IAM
Select Roles and then select Create Role
to create a new monitoring role.
Note that this is different from a cross-account role
Select Another AWS account
This is required to be able read the S3 logs,
and so the Oracle CASB Cloud Service can assume this role to monitor the AWS account
You will be prompted for the account ID and the external ID
The account ID is the Oracle CASB Cloud Service account ID
The external ID is generated during the registration process
Open a new tab and log into your Oracle CASB Cloud Service.
On the dashboard screen, select Add an App
Select Amazon Web Services AWS and navigate to the Select an Instance screen
Name your AWS application instance and then navigate to the Select Monitoring Type screen
This is where you will select which mode you want to register your AWS instance into Oracle CASB Cloud Service
Here you will assign a pre-existing AWS policy to the IAM role
You can register your AWS account into Oracle CASB Cloud Service
in one of two modes - read-only and read-write
In both modes you'll base line your AWS security controls in Oracle CASB Cloud Service
Any subsequent changes to the security controls in AWS will generate an alert
in Oracle CASB Cloud Service.
In read-write mode Oracle CASB Cloud Service can revert those changes back to the baseline settings
keeping your AWS instance in compliance
In read-write mode AWS requires Oracle CASB Cloud Service to have administrator access
to make these changes directly back into your AWS account
Read-only mode requires the read-only access policy
If you require read-only permissions on this IAM role, select Monitor only
if you want to revert security control changes back to the baseline automatically
and your security policies allow assigning the administrator access policy to this role
select Monitor and push controls
Navigate to the Select Security Control screen
Change the authentication type to IAM User Role and copy the external ID
Switch back to the tab with your AWS account and enter the external ID
Navigate to the Attach Policy Screen from where you can choose policies to attach to your new role
If you chose Monitor and push controls you must choose AdministratorAccess
if you selected Monitor only enter read-only access in the filter,
scroll to the bottom and select the policy
Give the role a name and then create the role
Then select the role you just created
At the bottom, expand the Inline Policies bar
to create an inline policy
choose Custom Policy
and click Select
Give the policy a name and enter the sts:AssumeRole statement here
making sure the resource is set to an asterisk.
Now apply the policy
The first line is the RoleARN, which is required to complete the registration in Oracle CASB Cloud Service.
Towards the bottom of the page, there are 4 tabs. Select Trust Relationship.
Under Trusted entities is the account number of Oracle CASB Cloud Service
Under Conditions, you'll see the external ID that was generated by Oracle CASB Cloud Service
Select Edit Trust Relationship. If the Oracle CASB Cloud Service tenant times out
If the Oracle CASB Cloud Service tenant times out
or you need to restart the AWS registration process
when you click to add the AWS application the process will generate a new external ID
You'll need to replace the value in the trust relationship with the most current one to match Oracle CASB Cloud Service
Switch to the Oracle CASB Cloud Service tab and enter the role ARN you copied earlier
Slide the Collect logs from an external account bar over to the right
At this point in the configuration its assumed that the CloudTrail has already been enabled
and that its sending it logs to a local S3 bucket on the target account
It is also assumed that cross-account logging has been configured so
the target account S3 bucket has a modified policy to allow source account CloudTrail logs
The source account's CloudTrail is sending logs to the target account's S3 bucket
and a cross-account role has been created in the target account
For more information on cross-account logging, please review the cross-account logging video in this series
Enter in the name of the cross-account ROLE you created in the TARGET account
Enter the Account number of the TARGET account and then Test the Credentials.
If all of the configurations are correct, you’ll be informed that the credentials are valid
Submit your action, and you’ll get notified that AWS is going through its first data ingestion
in your Oracle CASB Cloud Service tenant
Navigate back to the dashboard and you'll observe that this application is going through initial data ingestion.
Congratulations! You have successfully registered a SOURCE AWS into Oracle CASB Cloud Service
configured for cross account logging with an IAM Role.
Thank you for watching.