This walk-through will show the creation of an IAM user account for the source
AWS account configured in cross-account logging with the target account.
More information on cross-account logging can be found in other videos in this series
At this point in the configuration you should have - enabled cross-account logging,
created at the cross-account role in the target account,
modified the policy on the target S3 bucket to allow the source account cloud trail to write
logs to it and optionally, configured an IAM user to be used as a dedicated
service account by Oracle CASB to monitor the target account
First login to your source AWS account. To create the dedicated service account
create an IAM user account and assign a specific policy to it.
To do this select Services and then under Security Identity and Compliance, select IAM
Select Users to create the account. When you add this new user, you need to
provide a username. This user will never need to log into the AWS management
console but you will need the access keys. So select programmatic access and
navigate to the permissions screen
Here you're going to assign this user an existing policy. You can register your
AWS account into Oracle CASB Cloud Service in one of two modes: read-only and read-write
In both modes you'll baseline your AWS security controls in Oracle CASB Cloud Service.
Any subsequent changes to the security
controls in AWS will generate an alert in Oracle CASB Cloud Service
In read write mode Oracle CASB Cloud Service can revert those changes back to the
baseline settings keeping your AWS instance in compliance. However, in this
mode, AWS requires Oracle CASB Cloud Service to have administrator access to
make these changes directly back into or AWS account.
Read-only mode requires the read-only access policy.
Enter read-onlyaccess in the search filter,
scroll to the bottom and select the policy
Then navigate to the review screen
Verify the name of the IAM user
that the AWS access type is set to programmatic access with an access key
that the correct policy is attached to the IAM user and then create the user
Now download the CSV file to view the access keys
This is the only time you'll be able to do this. Iif you lose these access keys,
you'll have to regenerate a new set in IAM and update Oracle CASB Cloud Service
with them in order for Oracle CASB Cloud Service to monitor your AWS account
Best practice is to rotate your IAM user keys every 90 days so you'll
become familiar with this process if you aren't already
If you chose read-only access, you will need to add one more policy statement to
the user to allow it to use Amazon simple token service to assume the
cross-account role. This allows it to read the S3 bucket and provide the
metadata to Oracle CASB Cloud Service.
Select the user you just created and select Add Inline Policy
Choose a Custom Policy and click Select.
Name the policy and copy and paste the policy statement from the help documentation.
You will notice that the action to sts is to AssumeRole and the user is a variable.
Finally, apply the policy.
This is called a dedicated service account because it should be
dedicated to the Oracle CASB Cloud Service to monitor your AWS account.
No human nor any other application should use this account to log into your AWS accounts
Once you have downloaded your access keys, navigate back to the IAM
dashboard where you can view the user that you just created
With CloudTrail enabled, an S3 bucket collecting CloudTrail log data and the dedicated service account.
You are ready to register your AWS account into Oracle CASB Cloud Service
Congratulations! You created a dedicated service account for a source AWS account
configured in cross-account logging
Thank you for watching.