Connect AWS

Before you start

You need the AWS admin rights described below, and in Trusterio the right to manage integrations (owners and admins have it). Anybody else sees the page read-only.

Connect it

1. Open Automation and choose Connect on the AWS card. (The link opens the dialog straight away.)
2. Give it a name under What to call it, and read What to grant: every permission and what it is for.
3. Press Add it and enter the credential. You land on the connection’s own page.

1. Under Connect with CloudFormation, pick the Region your resources run in and press Connect AWS account. Your own AWS console opens with the stack ready.
2. Approve the stack in your console. You do not need the root account.
3. Back in Trusterio, the page waits for the stack and then checks the role can be used. That usually takes a minute or two.

The stack finished but nothing happened? Choose Enter the role ARN by hand and paste RoleArn from the stack’s Outputs tab. Would rather use an access key? Use an access key instead asks for the region, access key ID and secret.

What it creates

• One IAM role with a policy of read and list actions only, written for Trusterio rather than a broad managed policy. Do not attach SecurityAudit.
• An identity provider entry naming Trusterio, so each reading uses a credential that expires within the hour. No access key is stored.

What it reads

IAM users, MFA and the credential report; EC2 instances and security groups; RDS instances; S3 buckets, their encryption, public access and policies; load balancers; CloudTrail, Config, Security Hub, GuardDuty, Inspector and CloudWatch log groups; KMS key rotation. With an organisation, the list of its accounts, so you can connect the others with the same stack.

What it checks

• MFA for IAM users, no root access keys, the password policy, unused credentials, no wildcard policies
• S3: encryption, public access blocked, TLS required
• CloudTrail, AWS Config, Security Hub, GuardDuty and Inspector switched on
• EBS encryption by default, IMDSv2 on instances, no security group open to the world
• RDS: encryption, TLS, backups, Multi-AZ
• Load balancers listen on TLS, log retention is set, KMS keys rotate

Regional checks answer for the region you chose. A newer check that your stack does not allow yet says so, with the steps to update the stack.

After it is connected

• Press Sync now for the first reading. The Tests tab shows each check: what it should be, what was found, and what is affected.
• New connections are read by hand until you choose a schedule: in Monitoring, on the Collection tab, pick Every hour, Every 6 hours, Daily or Weekly.
• The page says when it was last read and its health; Sync History keeps every run.

A connection marked Beta on the Automation screen has not been tried on a real account yet: its permission list is our reading of the provider’s documentation. AWS, Azure, Google Cloud and Jira have been. If a permission is wrong, tell us.

Disconnect

On the connection’s page, choose Disconnect. Reading stops and its credentials are deleted; its history, checks and evidence stay. Then remove what you created at the provider:

• In CloudFormation, in that region, delete the trusterio-readonly-access stack.
• In IAM, delete the identity provider it added.