For AWS account monitoring, Oracle CASB Cloud Service can use either an IAM user
to act as a dedicated service account or an IAM role. AWS recommends the use of roles
as no access and secret keys are required and it's viewed as a more secure integration
This walkthrough will show the creation of an IAM role for a single or standalone AWS account
or a target AWS account configured in cross-account logging
This IAM role will replace the functionality of the IAM user account to monitor your AWS instance
At this point in the configuration it is assumed that CloudTrail has already been enabled
and that it is sending its logs to a local S3 bucket
Log in to your AWS console and select Services
Under Security Identity and Compliance select IAM
Navigate to Roles to create a new monitoring role. Note that this is different from a cross-account role
Then select Another AWS account
This is so the Oracle CASB Cloud Service can assume this role to monitor the AWS account
You will be prompted for the account ID and the external ID
The account ID is the Oracle CASB Cloud Service account ID
The external ID is generated during the registration process
Enter the account ID for Oracle CASB Cloud Service
Open a new tab and log into your Oracle CASB Cloud Service.
From the dashboard screen select Add an App and navigate to the Select an App Type screen
Seect Amazon Web Services AWS and navigate to the Select an Instance screen
Name your AWS application instance and then navigate to the Select Monitoring Type screen
This is where you will select which mode you want to register your AWS instance into Oracle CASB Cloud Service
Here you will assign a pre-existing AWS policy to the IAM role
You can register your AWS account into Oracle CASB Cloud Service
in one of two modes - read-only and read-write
In both modes you'll base line your AWS security controls in Oracle CASB Cloud Service
Any subsequent changes to the security controls in AWS will generate an alert
in Oracle CASB Cloud Service.
In read-write mode Oracle CASB Cloud Service can revert those changes back to the baseline settings
keeping your AWS instance in compliance
However in read-write mode AWS requires Oracle CASB Cloud Service
to have administrator access to make these changes directly back into your AWS account
Read-only mode requires the read-only access policy
If you want read-only permissions on this IAM role, select Monitor only
if you want to revert security control changes back to the baseline automatically
and your security policies allow assigning the administrator access policy to this role
select Monitor and push controls
Navigate to the Select Security Control screen
Change the authentication type to IAM User Role and copy the external ID
Switch back to the tab with your AWS account and enter the external ID
Navigate to the Attach Policy Screen from where you can choose policies to attach to your new role
If you chose Monitor and push controls you must choose AdministratorAccess
if you selected Monitor only enter read-only access in the filter
Scroll to the bottom and select the policy
Give the role a name and then create the role
Then select the role you just created
The first line is the role ARN which is required to complete the registration in Oracle CASB Cloud Service
Take a copy of this as it will be required later
Towards the bottom of the page, select Trust Relationship
Under Trusted Entities is the account number of Oracle CASB Cloud Service
Under Conditions, you'll see the external ID that was generated by Oracle CASB Cloud Service
Select Edit Trust Relationship. If the Oracle CASB Cloud Service tenant times out
or you need to restart the AWS registration process when you click to
add the AWS application the process will generate a new external ID
you'll need to replace the value in the trust relationship with the most current one to match Oracle CASB Cloud Service
Switch to the Oracle CASB Cloud Service tab and enter the role ARN you copied earlier
and then test the credentials
If all of the configurations are correct you'll be informed that the credentials are valid
Submit your action and you'll be notified that AWS is going through its first data ingestion
in your Oracle CASB Cloud Service tenant
Navigate back to the dashboard and you'll observe that this application is going through initial data ingestion
Congratulations! You have successfully registered AWS into Oracle CASB Cloud Service with an IAM role.
Thank you for watching.