Amazon Web Services (AWS) Connector Guide

Amazon Web Services (AWS) is one of the most comprehensive and broadly adopted public cloud platforms that enables users to easily deploy virtual machines and networks, as well as access over 200 native AWS services.

The Balbix integration with AWS ingests data from core services such as Amazon Elastic Compute Cloud (Amazon EC2), Amazon Simple Storage Service (Amazon S3) and AWS Identity and Access Management (IAM); database services such as Amazon Relational Database Service (Amazon RDS), container services such as Amazon Elastic Kubernetes Service (Amazon EKS) and analytics services such as the Amazon OpenSearch Service.

Balbix leverages AI to aggregate, normalize, and deduplicate ingested data, along with information integrated from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their business and operational context. Balbix’s AI models then analyze this data to provide insights such as deployment gap analysis, risk-based vulnerability prioritization (with detailed ranking and scoring), and risk quantification. This process delivers a comprehensive assessment of risk, whether for a single asset, groups of assets, or your entire enterprise, enabling more informed and effective security decisions.

Integration summary

This table provides a summary of the Balbix integration for the AWS connector.

Prerequisites

To configure the Balbix connector, you must first create AWS API credentials with the appropriate permissions. These credentials are required for completing the configuration process.

Create a role and assign permissions

To access AWS, an ARN value is required. Follow these steps to create a role and assign a permissions policy.

For master accounts

1. Log in to the AWS management console and select IAM Service.

2. In the left navigation pane, select Access management > Roles.

3. Click Create role. On the Role Creation screen:

   • Select AWS account as the trusted identity type.

   • Choose Another AWS Account and enter the following details from the Balbix connector configuration screen:

     • Balbix AWS Account ID: 022653893069

     • External ID: Leave this field blank for now. This value is typically your organization's domain name with periods replaced by hyphens (for example, corp.test..com becomes corp-test-com). The exact value will be confirmed in the Balbix connector configuration.

4. Click Next.

5. Add the Security Audit policy.

6. Create a new policy with the following permission:

   jsonCopy code{
     "Effect": "Allow",
     "Action": "sts:AssumeRole",
     "Resource": "*"
   }

   • Attach this newly created policy to the role.

7. For a Master Account: Add the newly created policy to the role.

8. Click Next.

9. Enter a role name and description, then click Create Role.

10. Copy the Role ARN and securely store it for later use when configuring the Balbix connector.

For linked accounts

1. Log in to the AWS Management Console for the linked account and select the IAM Service.

2. In the left navigation pane, go to Access Management > Roles.

3. Check if the OrganizationAccountAccessRole already exists

   • Ensure the role has the following trust relationship:

     {
       "Effect": "Allow",
       "Principal": {
         "AWS": "arn:aws:iam::[Master AWS Account ID]:root"
       },
       "Action": "sts:AssumeRole"
     }
     

   • If the trust relationship is correct, no further action is needed.

4. If the role does not exist or the trust relationship is incorrect:

   • Click Create Role.

   • On the role creation screen, select AWS account as the trusted identity type.

   • Choose Another AWS account and enter the following details from the Balbix connector configuration screen:

     • Balbix AWS Account ID: [Master AWS Account ID]

   • Click Next twice.

   • Name the role OrganizationAccountAccessRole and click Create Role.

5. Confirm that the trust relationship for the new role matches the one shown above.

Set up your AWS connector

After completing the prerequisites, follow these steps to configure your Balbix connector for AWS.

Step 1: Select the connector

Start by selecting a connector using the steps outlined below:

1. Go to Data Sources from the left navigation bar.

2. In the Connectors table, click + Add Connector.

3. Click Select a Connector to Configure to expand the window and view the list of available connectors.

4. Click the + icon on the Amazon Web Services (AWS) tile.

5. Click Next to configure the connector.

Step 2: Configure the connector

Configure the connector using the steps outlined below.

AWS Cloud Services Supported

The following cloud services are ingested as assets via this connector:

API reference documentation

For more information about the AWS API, see the following references:

• AWS Documentation

• What is an Amazon Gateway?

• SecurityAudit AWS Managed Policy Reference

• IAM Role Creation User Guide