Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Configure AWS in Skyhigh CASB

  1. Last updated
  2. Save as PDF

When integrating Skyhigh CASB for AWS, you will use the Account Settings page to enter your AWS account information and enter your organization information to auto discover the AWS accounts information associated with the particular organization. You can also choose to upload a CSV file of all AWS account information.

Before you begin, make sure you've created an Identity and Access Management (IAM) role in your AWS account to grant access to Skyhigh CASB. Assign the permission template "ReadOnlyAccess" to this role. Skyhigh CASB's Account ID and External ID are specific to you and will be available on the Skyhigh CASB dashboard while enabling AWS integration.

Limited Availability: To enable Enter my organization info method (found under Accounts), contact Skyhigh Support. 

Step 1: Create IAM Roles

To create an IAM Role in AWS with the required permissions:

  1. Log in to your AWS management account and select IAM from the services menu.
  2. Go to Users > Roles > Create role.
    clipboard_e451d70c98a75a57ad770c54652031f80.png
  3. Select Another AWS account, and copy the AWS account ID and external ID from the Skyhigh CASB dashboard into the AWS.
    2.png
  4. Select the ReadOnlyAccess permission.
    clipboard_e824f76cdaa8d7bdf95042c324833d7a4.png
  5. Enter the preferred Role name. For example, OrgRoleTest. For more information, see Configure Skyhigh CASB IAM Roles for AWS. 
    clipboard_e1df82e926e0e3b7c2169072b9ffcf528.png
  6. Click Create role.
  7. The new role name is now created. Click the role name in AWS.
    clipboard_ef831fb4ccf4b69e88b336c1ffc215a71.png
  8. Copy the Role ARN and paste the Role ARN into Skyhigh CASB (refer to the instructions in Step 2: Integrate AWS).
    clipboard_e1ff7b95ccb88ca2d721be1acb4016889.png

Step 2: Integrate AWS

To integrate AWS:

  1. Log in to Skyhigh CASB and go to Settings > Service Management.
  2. Click Add Service Instance and select Amazon Web Services (AWS). 
  3. Add an Instance Name and click Done.
  4. On the Setup tab, click API Enable. 
  5. You are redirected to the Features page. Select the features you want to enable for your AWS account:
    • DLP. Select this option to automatically enable the Near Real Time and On Demand Scan. 
      • Select Near Real Time to enable NRT DLP scan. For details, see Near Real Time DLP and Malware Scan.
      • Select On Demand Scan to provide Data Loss Prevention (DLP) protection to files stored in Amazon S3 Buckets. 
    • Activity Monitoring. Select this option to monitor the activity of AWS users and detect risk activity trends for the entire organization over time. If you do not select this option, you don't need to provide AWS Bucket names to Skyhigh CASB. Learn more
    • Security Configuration Audit. Select this option to automatically enable the configuration audit and real-time configuration audit policies. Learn more
      aws_features.png
  6. Click Next. Review the mandatory prerequisites, click the checkbox, and click Next.
  7. Under Add Accounts, choose any method to provide AWS account information to Skyhigh CASB:
Enter my account info
  1. Choose this option, then type each AWS account's Role ARN, Preferred Name, and AWS Bucket Name.
  2. Click Add. You can add multiple AWS account details.
  3. To authenticate the information of your AWS account, click Authenticate Accounts.
    clipboard_e89560e805f272d50d48b215651de5907.png
Enter my organization info
  1. Choose this option, then type AWS organization's Role ARN, Preferred Name, and AWS Bucket Name. 
  2. To auto discover all the accounts from the organization info, click Discover. For more details to create AWS Organization Role ARN, see Create AWS Organization Role.
    clipboard_ef23b0ba0201736f1e98460a15452857d.png
  3. The Organization details are displayed. You can either select the edit icon or the link under Accounts to view all the accounts associated with the particular organization.
    clipboard_ef45c0ed590c9b5114dcfa9309630993a.png
  4. On the Edit Organization and Accounts page, select all or the required accounts for your organization. click Save.
    clipboard_e678c06f29e15e3334bf1c35f3af55fc2.png
Upload a CSV with account info
  1. Choose this option only if you have a CSV file in the following format. 
role-arn, preferred-name, aws-bucket-name
role-arn, preferred-name, aws-bucket-name
  1. To upload a CSV file, click Upload CSV.
  2. To authenticate the information of your AWS account, click Authenticate Accounts.
  1. On the unsuccessful authentication, you are redirected to the error screen. You can go back and fix the errors or if you do not want to fix the errors, click Continue With Error. 
    clipboard_e6981074d702876778a4082a91c84932b.png

NOTE: Some features might not work as expected if you click Continue With Error.
 

  1. Complete the further steps and go to Policies & Notifications.
  2. Select the pre-populated email ID(s) to notify any Configuration Audit Policy violation incidents. Alternatively, you can manually enter an email in the description box. For details, see Configure Account Administrator Email Notification.
  3. Click Next.
    clipboard_e666df61f20ac525776f1afc3bf98bfe4.png
  4. On the Summary page, verify your settings, and to complete the integration, click Save.

Create AWS Organization Role 

To create AWS Organization role, you need to follow these steps:

  1. Create IAM role in AWS Management Account. For details, see Create IAM Roles.  
  2. Create CloudFormation Template file. For details, see Create CFT.
  3. Create Organization Role in AWS Member Account. For details, see Create Organization Role.

Create CloudFormation Template File (CFT)

  1. Download the CloudFormation Template to create AWS Organization role.
  2. The templates expect the following inputs:
    • Role Name. Enter the IAM role name. 
    • Policy Name. Enter the IAM permissions. 
  3. Save the inputs. The CloudFormation template file will be saved in JSON or YAML format. Later, you can use this to create Organization role in AWS member account. 

NOTE: Your CFT template must contain the same role name and permissions as your AWS management account.

Create Organization Role in AWS Member Account

To create role for all member accounts in an organization, follow these steps:

  1. Log in to AWS console as a root/admin user.
  2. Go to CloudFormation > StackSets > Create StackSet.
  3. Under Choose a template, configure the below options and click Next.
    • For Permissions, select Service-managed permissions.
    • For Prerequisite - Prepare template, select Template is ready.
    • For Specify template > Upload a template file, browse and upload CFT template file saved in JSON or YAML format.
      clipboard_e32923f25166014cd3508b8d6ad11a04c.png
  4. Under Specify StackSet details, add the following information and click Next.
    • StackSet name. Enter the name for StackSet.
    • StackSet description. Enter the description for StackSet. You can use the description to identify the stack set's purpose or other important information.
    • Parameters. Enter the parameters that are defined in your template. Parameters allow you to input custom values when you create or update a stack.
      clipboard_e90515ea00a6d0a006bcbca7cacade16f.png
  5. Under Configure StackSet options, provide the required tags only if required and click Next.
  6. Under Set deployment options, configure the below options and click Next.
    • For Add stacks to stack set, select Deploy new stacks.
    • For Deployment targets, select Deploy to organization.
    • For Auto-deployment options, configure these:
      • Activate Enabled for Automatic deployment.
      • Activate Delete stacks for Account removal behavior.
        clipboard_e4855ff3bbcee46d754763a0be28413ed.png
  • Under Specify regions, choose the region in which you want to deploy stacks. Your selected regions are deployed in the order you specify.
    clipboard_e521ad19b34d4aeb2c63cd6d33823d5b5.png
  1. Under Review, verify your changes and save to create the stack set.
  2. Go inside the StackSet and check the Stack instances.
  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    Topic
  2. Tags
    1. AWS
    2. iaas
    3. Topic ID 133
    4. Topic ID 146
    5. Topic ID 172