Versions Compared

Old Version 67

changes.mady.by.user Luke Fritz (Unlicensed)

Saved on

compared with

New Version 68

changes.mady.by.user Luke Fritz (Unlicensed)

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Topics Discussed

minLevel
Section
id136144588
Section
id136144600
Section
background-color$lightGrayColor
id136144586
Table of Contents
maxLevel3
3
Section
id136144589
Note

To fully use this screen, you must add the following permissions to your account:

  • Read Cloud Connections
  • Write Cloud Connections

Anchor
Overview
Overview

You can use the Cloud Connections screen to sync your public cloud account into the Armor Management Portal (AMP). Afterwards, you can use AMP to:

  • Collect and store logs with the Log Relay add-on product

  • View the security status of your instance in the Virtual Machines screen

    Note

    While all instances from your public cloud account will appear in the Virtual Machines screen, you should only focus on the security status for the instances that contain the Armor agent.

  • Add AWS Security Hub feature to your public cloud account.


Review Cloud Connections

...

The Cloud Connections screen displays the public cloud accounts you have synced.

ColumnDescription
Account Name

This column displays the descriptive name for your account.

You can also click the arrow to see which Armor services are associated with the account.

ProviderThis column displays the public cloud provider.
Account ID

This column displays the ID for your public cloud account.

StatusThis column displays the connection status between your Armor accounts and your public cloud account.


Anchor
Add an AWS public cloud account
Add an AWS public cloud account
Add an AWS Public Cloud Account

...

You can use the Cloud Connections screen to sync your AWS public cloud environment with the Armor Management Portal (AMP).

To complete these instructions, you must be able to access your AWS console.

Note

Armor will generate an External ID for every new Cloud Connection account. As result, an incomplete cloud connection account will be listed in the table as (Pending Connection). You can click this entry in order to continue with the cloud connection creation process.


Step 1: Add your AWS account to AMP

  1. In the Armor Management Portal (AMP), in the left-side navigation, clickAccount.
  2. ClickCloud Connections.
  3. Click the plus ( + ) icon.

    Image Modified

  4. In Account Name, enter a descriptive name.
  5. In Description, enter a short description.

    Image Modified

  6. In Services,select the desired services.
    • To have Armor send security findings to your AWS Security Hub, markSecurity Hub.
      • This action will automatically select additional services; these services must be selected.

        Image Modified

  7. In IAM Role, copy theExternal ID. You will need this information at a later step.
    • TheArmor's AWS Account Number andExternalIDfields are pre-populated.
    • Armor will generate an External ID for every new Cloud Connection you create.
    • In a later step, you will locate the information to complete theIAM Role ARN field.

      Image Modified

  8. Access the AWS console.
  9. Under Security, Identity & Compliance, click IAM.

    Image Modified

  10. In the left-side navigation, click Roles.
  11. Click Create role.

    Image Modified

  12. Under Select role type, selectAnother AWS account.
  13. In Account ID, enter 679703615338.

    Image Modified

  14. MarkRequire external ID.
  15. In field that appears,paste the External ID you copied earlier from the Armor Management Portal (AMP).

    Image Modified

  16. Do not mark Require MFA.
  17. ClickNext: Permissions.
  18. Locate and mark the SecurityAudit policy.
  19. Locate and mark theAWSSecurityHubFullAccess policy.
    Image Modified
  20. Click Next: Tags.
  21. ClickNext: Review.
  22. In Role name, enter a descriptive name.
  23. In Role description, enter a useful description.

    Image Modified

  24. Click Create role.
  25. Locate and select the newly created role.
  26. UnderSummary, copy theRole ARNinformation.

    Image Modified

  27. Return to the Cloud Connections screen in AMP.
  28. Paste theRole ARNinformation into the IAM Role ARN field.
  29. Click Save Cloud Connection.
    • Once the newly added cloud connections gathers data, the instance will appear in the Virtual Machines screen.


Step 2: Configure Your AWS Regions

In this step, you will enable AWS Security Hub in the desired AWS regions; this action will capture the findings from Security Hub in every configured region.

  1. Access the AWS console.
  2. Access theSecurity Hubsection.
  3. In the left-side navigation, clickIntegrations.
  4. Locate and selectARMOR Armor Anywhere.

    Image Modified

  5. ClickEnable.
  6. In the pop-up window, clickEnable.


Anchor
View your public cloud instances
View your public cloud instances
View Your Added (connected) Public Cloud Instances

...

After you add your public cloud account into the Armor Management Portal (AMP), you can view the corresponding instances (and their security status) in the Virtual Machines screen.

Note
The Cloud Connection screen simply lists the synced public cloud account; the Virtual Machines screen lists all the instances listed in that public cloud account.
  1. In the Armor Management Portal (AMP), in the left-side navigation, click Infrastructure.
  2. Click Virtual Machines.
ColumnDescription
NameThe name of the instance from your public cloud account
TypeThe type of instance, specific to the offerings offered by your public cloud provider, such as en EC2 instance for AWS
ProviderThe public cloud provider for the instance
OS

The operating system associated with the instance

(For AWS, the associated AMI is listed)

Date CreatedThe date the instance was created in your public cloud account
Security Group

The security group that corresponds to your AWS instance.

  • This column will only appear to AWS users.
  • This column will only appear if you have selected the EC2 Metadata and orchestration option.
Keypair

The keypair that corresponds to your AWS instance.

  • This column will only appear to AWS users.
  • This column will only appear if you have selected the EC2 Metadata and orchestration option in the Cloud Connections screen..
State

The security status of the instance, in relation to the installed agent. There are three states:

  • Unprotected indicates the agent is not installed in the instance.
  • Needs Attention indicates that the agent is installed, but has not properly communicated (heartbeated) with Armor.
  • OK indicates that the agent is installed and has communicated (hearbeated) with Armor.
PowerThe power status of the instance, either powered on (green) or powered off (red)
Info

Anchor
Troubleshooting Cloud Connections screen
Troubleshooting Cloud Connections screen
Troubleshooting

If you do not see any data in the Cloud Connections screen, consider that:

  • You do not have permission to view log data.
    • You must have the Read Cloud Connections and Writer Cloud Connectionspermissions enabled to view log data. Contact your account administrator to enable this permission. To learn how to update you permissions, see Roles and Permissions.


Related Documentation

To specifically sync your AMP account with AWS Security Hub, see Create a Cloud Connection for AWS Security Hub.




Was this helpful?


Topics Discussed

Table of Contents
maxLevel3
minLevel3