AWS
Adding an AWS account gives Cloud Defense access to it through an IAM role you create in the account. Cloud Defense discovers the account's resources into Inventory, runs posture monitoring checks against them, and, with Read/Write access, can apply the checks' remediation actions. The same setup forwards CloudTrail events and Security Hub findings, which keeps inventory current between daily discoveries and is what the threat detectors run on.
Everything is created by a CloudFormation stack (or the equivalent Terraform) whose parameters Cloud Defense fills in for you. You always own the role; it exists in your account and you can review or remove it at any time.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| The 12-digit AWS account ID | It identifies the account in Cloud Defense | AWS console, account menu (top right) |
| Permission to create a CloudFormation stack that creates IAM resources in that account | The stack creates the role and its policies | Your IAM permissions in the account |
For an AWS Organizations rollout, access to the organization's management account and the root ID (r-…) or the OU IDs (ou-…) to cover | The StackSet is created from the management account | AWS Organizations in the console |
Set up an AWS account
- In Cloud Defense, go to Settings > Cloud Accounts and click Add Cloud Account.
- Cloud Provider: AWS. Enter the AWS Account ID, a name, a project, and the Account Environment.
- Cloud Defense Access: Read Only to assess and suggest, or Read/Write to also let Cloud Defense apply remediation actions. See Access levels.
- Save. You land on the Provision page, which offers three ways to create the role. Pick one:
- CloudFormation, for a single account. Sign in to that AWS account in the console, then open the Quick create stack link. The parameters are pre-filled from your account; leave them as they are, tick I acknowledge that AWS CloudFormation might create IAM resources, and create the stack.
- AWS Organizations CloudFormation, for many accounts at once. Sign in to the organization's management account, open the Quick create stack link, and enter the root ID or a comma-separated list of OU IDs to cover. Everything else is pre-filled.
- Terraform. Download the template from the link, copy the tfvars text, and apply the template with those variables.
- Once the stack has finished creating, click Verify Account Access. It reports Access to this account has been successfully verified. when Cloud Defense can assume the role. Discovery starts on its own from there, and findings appear under Posture Monitoring once the first checks have run.
If you'd rather review what the stack does before creating it, open the template URL shown on the quick-create page, or choose Create change set so CloudFormation lists the resources first.
What the stack creates
| Resource | Purpose |
|---|---|
An IAM role under the path /CloudDefense/ | The role Cloud Defense assumes. Only Cloud Defense can assume it, and only with an external ID. It carries the AWS-managed SecurityAudit policy plus a custom policy with a few additional read-only permissions that SecurityAudit lacks |
| A small function that runs once while the stack is created | Registers the role with Cloud Defense |
| A StackSet that adds an event rule in each selected region | Forwards CloudTrail events and Security Hub findings to Cloud Defense for near-real-time updates. Not created for free-tier clients |
The region list for the StackSet defaults to every AWS region. If some regions are disabled in your account, remove them from the EventRegions parameter before creating the stack; a disabled region makes the StackSet fail.
With Read/Write access, the role also carries a write policy. It contains only the permissions the supported remediation actions need, listed per action on the Check Actions page, and the role is explicitly denied from changing its own policies.
With Events Only access, the stack creates no role for Cloud Defense to assume. It only forwards events, and the account's resources aren't discovered into Inventory.
Verify it landed
| What to check | Where to look |
|---|---|
| Cloud Defense can assume the role | Verify Account Access succeeds, and the Provision page shows This account has been provisioned. with no Resource Errors |
| The account has no discovery errors | Settings > Cloud Accounts: no red warning icon on the account's row |
| The resources themselves | Inventory, filtered by the account. Supported resources lists what discovery covers |
| Findings | Posture Monitoring, after the first checks run |
| Events are arriving | Events lists the account's CloudTrail events shortly after they happen, and a change such as tagging an instance shows up in Inventory within a few minutes rather than after the next daily discovery |
Keeping the stack current
The template is updated as discovery covers more services. Once the account is provisioned, the CloudFormation tab on the Provision page switches to showing an AWS CLI command that updates your existing stack to the latest template. You can run it from AWS CloudShell. To preview the changes first, download the template at the --template-url in the command, or update the stack with a change set.
Resource Errors on the Provision page whose message mentions Access Denied or not authorized usually mean the stack is behind the template; updating it adds the missing permissions.
Details and edge cases
Deleting the stack removes the role, and discovery stops at the next run with permission errors. Delete the account in Cloud Defense as well, so it doesn't keep reporting errors.
Free-tier clients don't receive events. The stack is created without the event StackSet, so inventory updates only on the daily discovery and the threat detectors have nothing to run on.
AWS documentation
- Creating a stack from a quick-create link: what the Quick create stack page is
- Updating stacks using change sets: previewing a template update before applying it
- SecurityAudit managed policy: the bulk of what the role can read
- Working with StackSets: how the Organizations rollout and the per-region event rules are deployed
Supported resources
Discovery covers the AWS resource types below. The ID column is the type each resource is listed under in Inventory.
Show all 103 resource types
| Name | ID |
|---|---|
| Access Analyzer | AWS::AccessAnalyzer::Analyzer |
| Account | Custom::AWS::Account |
| Amazon Inspector | Custom::AWS::InspectorV2::Inspector |
| Amazon Inspector Covered Resource | Custom::AWS::InspectorV2::CoveredResource |
| Amazon Macie | AWS::Macie::Session |
| API Gateway API Key | AWS::ApiGateway::ApiKey |
| API Gateway HTTP API | AWS::ApiGatewayV2::Api |
| API Gateway REST API | AWS::ApiGateway::RestApi |
| AppRunner Service | AWS::AppRunner::Service |
| Athena DataCatalog | AWS::Athena::DataCatalog |
| Athena WorkGroup | AWS::Athena::WorkGroup |
| Auto Scaling Group | AWS::AutoScaling::AutoScalingGroup |
| Auto Scaling Launch Configuration | AWS::AutoScaling::LaunchConfiguration |
| Backup Plan | AWS::Backup::BackupPlan |
| Certificate Manager (ACM) Certificate | AWS::CertificateManager::Certificate |
| CloudFormation Stack | AWS::CloudFormation::Stack |
| CloudFront Distribution | AWS::CloudFront::Distribution |
| CloudTrail Trail | AWS::CloudTrail::Trail |
| CloudWatch Alarm | AWS::CloudWatch::Alarm |
| CloudWatch Events Rule | AWS::Events::Rule |
| CloudWatch Log Group | AWS::Logs::LogGroup |
| CodeBuild Project | AWS::CodeBuild::Project |
| CodeCommit Repository | AWS::CodeCommit::Repository |
| Config Configuration Recorder | AWS::Config::ConfigurationRecorder |
| DynamoDB Accelerator Cluster | AWS::DAX::Cluster |
| DynamoDB Table | AWS::DynamoDB::Table |
| EC2 Elastic IP Address (EIP) | AWS::EC2::EIP |
| EC2 Flow Log | AWS::EC2::FlowLog |
| EC2 Image | AWS::EC2::Image |
| EC2 Instance | AWS::EC2::Instance |
| EC2 Network ACL | AWS::EC2::NetworkAcl |
| EC2 Network Interface | AWS::EC2::NetworkInterface |
| EC2 Route Table | AWS::EC2::RouteTable |
| EC2 Security Group | AWS::EC2::SecurityGroup |
| EC2 Service Configuration | AWS::EC2::ServiceConfiguration |
| EC2 Snapshot | AWS::EC2::Snapshot |
| EC2 Subnet | AWS::EC2::Subnet |
| EC2 Transit Gateway | AWS::EC2::TransitGateway |
| EC2 Transit Gateway Attachment | AWS::EC2::TransitGatewayAttachment |
| EC2 Transit Gateway Route Table | AWS::EC2::TransitGatewayRouteTable |
| EC2 Volume | AWS::EC2::Volume |
| EC2 VPC | AWS::EC2::VPC |
| EC2 VPC Endpoint | AWS::EC2::VpcEndpoint |
| EC2 VPC Peering Connection | AWS::EC2::VpcPeeringConnection |
| ECR Repository | AWS::ECR::Repository |
| ECS Task | AWS::ECS::Task |
| ECS Task Definition | AWS::ECS::TaskDefinition |
| EFS File System | AWS::EFS::FileSystem |
| EKS Cluster | AWS::EKS::Cluster |
| Elastic Load Balancer | AWS::ElasticLoadBalancing::LoadBalancer |
| Elastic Load Balancer V2 | AWS::ElasticLoadBalancingV2::LoadBalancer |
| Elastic Load Balancing V2 TargetGroup | AWS::ElasticLoadBalancingV2::TargetGroup |
| ElastiCache Replication Group | AWS::ElastiCache::ReplicationGroup |
| Fault Injection Simulator Experiment | AWS::Fis::Experiment |
| Firehose Delivery Stream | AWS::Firehose::DeliveryStream |
| Glue Connection | AWS::Glue::Connection |
| Glue Data Catalog Encryption Settings | AWS::Glue::DataCatalogEncryptionSettings |
| Glue Data Catalog Resource Policy | AWS::Glue::ResourcePolicy |
| Glue Database | AWS::Glue::Database |
| Glue Dev Endpoint | AWS::Glue::DevEndpoint |
| Glue Job | AWS::Glue::Job |
| Glue ML Transform | AWS::Glue::MLTransform |
| Glue Security Configuration | AWS::Glue::SecurityConfiguration |
| GuardDuty Detector | AWS::GuardDuty::Detector |
| IAM Account | Custom::AWS::IAM::Account |
| IAM Group | AWS::IAM::Group |
| IAM Identity Center | Custom::AWS::IAM::IdentityCenter |
| IAM Instance Profile | AWS::IAM::InstanceProfile |
| IAM Managed Policy | AWS::IAM::ManagedPolicy |
| IAM Role | AWS::IAM::Role |
| IAM SAML Provider | AWS::IAM::SAMLProvider |
| IAM Server Certificate | AWS::IAM::ServerCertificate |
| IAM User | AWS::IAM::User |
| IAM Virtual MFA Device | AWS::IAM::VirtualMFADevice |
| Kinesis Stream | AWS::Kinesis::Stream |
| KMS Key | AWS::KMS::Key |
| Lambda Function | AWS::Lambda::Function |
| OpenID Connect Provider | AWS::IAM::OIDCProvider |
| OpenSearch Domain | AWS::OpenSearch::Domain |
| RDS DB Cluster | AWS::RDS::DBCluster |
| RDS DB Cluster Snapshot | AWS::RDS::DBClusterSnapshot |
| RDS DB Instance | AWS::RDS::DBInstance |
| RDS DB Parameter Group | AWS::RDS::DBParameterGroup |
| RDS DB Snapshot | AWS::RDS::DBSnapshot |
| RDS Option Group | AWS::RDS::OptionGroup |
| Redshift Cluster | AWS::Redshift::Cluster |
| Region | Custom::AWS::Region |
| Route53 Hosted Zone | AWS::Route53::HostedZone |
| S3 Account | Custom::AWS::S3::Account |
| S3 Bucket | AWS::S3::Bucket |
| SageMaker Notebook Instance | AWS::SageMaker::NotebookInstance |
| Secrets Manager Secret | AWS::SecretsManager::Secret |
| Security Hub | AWS::SecurityHub::Hub |
| SNS Subscription | AWS::SNS::Subscription |
| SNS Topic | AWS::SNS::Topic |
| SQS Queue | AWS::SQS::Queue |
| SSM Document | AWS::SSM::Document |
| SSM InstanceInformation | AWS::SSM::InstanceInformation |
| WAF v2 IP Set | AWS::WAFv2::IPSet |
| WAF v2 Logging Configuration | AWS::WAFv2::LoggingConfiguration |
| WAF v2 Regex Pattern Set | AWS::WAFv2::RegexPatternSet |
| WAF v2 Rule Group | AWS::WAFv2::RuleGroup |
| WAF v2 Web ACL | AWS::WAFv2::WebACL |