Page Comparison

...

Click on Roles from the left hand side menu to begin then click Create role button to create a new IAM Role.
Image RemovedImage Added
Under Select type of trusted entity An AWS account select Another AWS account and enter the 12 digit Account ID of Zilla (087210011007). Select the Options checkbox for ‘Require external ID’ and enter the External ID field as your tenant’s domain name. Click Next: Permissions.
On the permissions page, search for the policy SecurityAudit , and select the checkbox. Click Next: Tags.
Optionally add tags and click Next: Review.
On the review page, add the name of the role Zilla-IAM-Reader-Role and optionally add a description. Review the trusted entity account id matches Zilla’s account Id (087210011007) and that the Policies permissions section contains SecurityAudit. Click Create role.
Once the role is created, you can search for it on the Roles tab and click on the role to check its details.
On the role details page, double check the policy under Trust relationships that Trusted entities has Zilla Account ID (087210011007) and your domain name as ExternalId condition.
Image RemovedImage Added

Info

Notes:

Copy the Role ARN. For example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role and keep it handy for later.
Typically IAM Users and Groups are created against each AWS Account, so you will need to create the above role and policy for each of your AWS Accounts.
Currently, the IAM Role and Policy creation to bring in IAM Users and Groups is mandatory in Zilla.

Bring SSO Users, Groups and Permission Sets into Zilla

Create an IAM Policy for SSO Users, Groups and Permission Set

Steps to create an IAM Policy

...

Click on Policies on the left hand side menu of the IAM dashboard.

...

Click Create policy and click on the JSON tab.

...

To Bring the SSO users, Groups and Permission

...

Code Block
{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "identitystore:Describe", "identitystore:List" ], "Resource": "*" } ] }

...

Optionally add tags and click Next: Review.

...

Review Policy: On the review page, enter the Name (Zilla-SSO-Reader-Policy) and optionally a description for the policy. Review the permissions assigned to the policy and then click Create policy. The policy will look like this:

...

You will see a success message like this:

...

To confirm that the policy is present, you can search for it in the policy search bar. You will see your newly added policy in the list.

...

Click the policy Zilla-SSO-Reader-Policy to double check the assigned permissions. The policy will look like this:

Click on the {} JSON tab to double check the policy json.

...

Now that you have created the policy, the next step is to create a cross account Role.

Create an IAM Role for SSO Users, Groups and Permission Set

Steps to create an IAM Role

Click Roles from the left hand side menu to begin.
Image Removed
Click Create role button to create a new IAM Role. Under Select type of trusted entity select Another AWS account and enter the 12 digit Account ID of Zilla (087210011007). Select the Options checkbox for ‘Require external ID’ and enter External ID as your tenant’s domain name, then click Next: Permissions.
Image Removed
On the permissions page, search for AWSSSOReadOnly policy, and select the checkbox.
Image Removed
Also search for the policy created ,Zilla-SSO-Reader-Policy , and select the checkbox. Then click Next: Tags.
Image Removed
Optionally add tags and click Next: Review.
Image Removed
On the review page, add the name of the role Zilla-SSO-Reader-Role and optionally add a description. Ensure the Trusted entities account id matches Zilla’s account Id (087210011007) and that the Policies section contains Zilla-SSO-Reader-Policy, then click Create roled.
Image Removed
Once the role is created, you can search for it on the roles tab and click on the role to check its details.
Image Removed
On the role details page, double check the policy under Trust relationships that Trusted entities has Zilla Account ID (087210011007) and your domain name as ExternalId condition.
Image Removed

Info

Notes:

Copy the Role ARN. For example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-SSO-Reader-Role and keep it handy for later.
Typically organizations will have one MASTER AWS ACCOUNT under which they will setup multiple Users, Groups, Permission Sets and AWS Accounts. So it’s likely you will need to create the SSO Role and Policy creation only once against your MASTER AWS ACCOUNT.
Currently, the IAM Role and Policy creation to bring in SSO Users, Groups and Permission Sets is optional in Zilla.

Things to keep handy

For IAM Users and Groups: Copy the Role ARN. For eg: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role created above.
For SSO Users and Groups:, you need to keep the following things handy:
1. Copy the SSO Role ARN of your Master AWS Account. For eg: arn:aws:iam::<YOUR_AWS_SSO_MASTER_ACCOUNT_ID>:role/Zilla-SSO-Reader-Role created above
2. ARN of the SSO Instance
3. Identity Store Id of the Identity Provider of SSO Instance
4. 12 digit Account ID of the AWS Instance for which you want to bring in SSO Users and Groups
5. AWS Region under which AWS SSO is setup
6. AWS SCIM Endpoint
7. AWS SCIM Access Token
Here are the instructions to get the above details:
1. In the search bar at the top, search for AWS SSO and click on the search result called AWS Single Sign-On as shown below.
  Image Removed
2. You will land on the AWS SSO dashboard.
  Image Removed
3. Click the Settings option on the left menu.
  Image Removed
4. Copy the ARN of the SSO Instance and keep it handy. It will look something like this: arn:aws:sso:::instance/ssoins-<SOME_ALPHANUMERIC_ID>.
5. Also, copy the Identity store ID. It will look something like this: d-<SOME_NUMBERS> .
6. Next, click the AWS accounts option from the left menu.
  Image Removed
7. Copy the 12 digit Account Id of the AWS Account whose Permission sets assignments you want to get.
8. Copy the region in which the AWS SSO Organization has been created. For eg: us-east-1.
  Image Removed
9. Go back to Settings to get the Automatic Provisioning (SCIM) details
  Image Removed
  You can only get the SCIM details if Automatic Provisioning is enabled. You can choose to keep Automatic Provisioning disabled or choose to enable at this point. If Automatic Provisioning is disabled, Zilla won’t be able to track the Active Status of a user.
10. To enable Automatic Provisioning, click Enable automatic provisioning.
  Image Removed
  Copy the SCIM endpoint and keep it handy.
11. Click Show token and copy the token and save it for a later step. Note that this token is available to be copied only once.
  Image Removed

sets into AWS app, this AWS app must have AWS Organization app as Parent.

...

Follow the steps for AWS Organization Sync for this AWS apps’s Parent Application https://zilla.atlassian.net/wiki/pages/resumedraft.action?draftId=2210168855

Info

Notes:

“Discover Child Apps” configuration should be set as “Yes” in the AWS Organization App which is parent of this AWS app.
“Sync AWS SSO accounts in Child AWS Apps” configuration should also be set as “Yes” in the AWS Organization parent App.
The AWS Organization App adds SSO configurations to it’s child AWS apps. These SSO configurations are hidden in the child AWS apps.
The configurations of the discovered AWS child Apps should not be edited manually. If the configurations are edited manually, it removes the hidden SSO configurations.
If the configurations are edited manually, then it’s Parent AWS Organization App should be synced first. So it will again add the hidden SSO configurations to this child AWS app.

Refer AWS - Hidden SSO configurations for more details.

Set up AWS Application Integration on Zilla

Login to Zilla at http://app.zillasecurity.com/.
Once you are signed in, you will land on the Applications page.
Click Add Application. You will see a library of all applications listed which are supported by Zilla.
Type “aws” into the search bar to filter the results.
Click on Add to Applications next to the Amazon Web Services entry. You will see a dialog box appear.
Image Removed
All the fields are optional. Click Add to Applications.
Image Added
You will be redirected back to the Applications page and you will see the Amazon Web Services entry included in the list.
Click the application instance to configure its integration.
Image RemovedImage Added
Click Sync Now in the top right corner. You will see a dialog box appear.
Click the slider under API Integration to enable.
Image RemovedEnter the values you copied from the Things to keep handy section above Image Added
Enter the Role ARN. For eg: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role created above. and click Next.
Image Added
Click Next again.
Your sync will begin. Once it completes, you will see the below message.
Click Done . You will then see a message like this if the sync completed successfully.
You can close the message dialog and navigate to the Accounts tab to the IAM Users from your AWS account.
Next, click the Permissions tab to browse the permissions assigned to each user.