Page Comparison

...

Table of Contents

minLevel	1
maxLevel	7
printable	false

Login to AWS console and go to IAM dashboard

Login to the AWS Account via the AWS Management Console
Image Removed
Enter your 12-digit account number. Click Next and then enter your username and password to login.
Once you are logged in, you will land on the home page with a search bar at the top.
Image Removed
In the search bar, search for IAM and click on the search result called IAM.
Image Removed
You will be redirected to the IAM dashboard.
Image Removed

Bring in IAM Users and Groups into Zilla

...

Create an IAM Role for IAM Users and Groups

Steps to create an IAM Role

Click on Roles from the left hand side menu to begin then click Create role button to create a new IAM Role.
Image Removed
Under An AWS account select Another AWS account and enter the 12 digit Account ID of Zilla (087210011007). Select the Options checkbox for ‘Require external ID’ and enter the External ID field as your tenant’s domain name. Click Next.
Image Removed
On the permissions page, search for the policy SecurityAudit , and select the checkbox. Click Next.
Image Removed
Optionally add tags and click Next: Review.
Image Removed
On the review page, add the name of the role Zilla-IAM-Reader-Role and optionally add a description. Review the trusted entity account id matches Zilla’s account Id (087210011007) and that the permissions section contains SecurityAudit. Click Create role.
Image Removed
Once the role is created, you can search for it on the Roles tab and click on the role to check its details.
Image Removed
On the role details page, double check the policy under Trust relationships that Trusted entities has Zilla Account ID (087210011007) and your domain name as ExternalId condition.
Image Removed

Info

Notes:

Copy the Role ARN. For example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role and keep it handy for later.
Typically IAM Users and Groups are created against each AWS Account, so you will need to create the above role and policy for each of your AWS Accounts.
Currently, the IAM Role and Policy creation to bring in IAM Users and Groups is mandatory in Zilla.

Include Page

	AWS - Create an IAM Role for IAM Users, Groups, Roles and Resources
	AWS - Create an IAM Role for IAM Users, Groups, Roles and Resources

Bring SSO Users, Groups and Permission Sets into Zilla

To Bring the SSO users, Groups and Permission sets into an AWS app instance in Zilla, this AWS app instance must have AWS Organization app instance as Parent Application.

...

Follow the steps here for AWS Organization Sync for this AWS apps’s app instance’s Parent Applicationhttps://zilla.atlassian.net/wiki/pages/resumedraft.action?draftId=2210168855

Info

Notes:

“Discover Child Apps” configuration should be set

as

to “Yes” in the AWS

Organization

Organizations App which is parent of this AWS app.
“Sync AWS SSO accounts in Child AWS Apps” configuration should also be set

as

to “Yes” in the AWS

Organization

Organizations parent App.
The AWS

Organization

Organizations App adds SSO configurations to

it’s

its child AWS apps. These SSO configurations are hidden in the child AWS apps.
The configurations of the discovered AWS child Apps should not be edited manually. If the configurations are edited manually, it removes the hidden SSO configurations.

If the configurations are edited manually, then it’s Parent AWS Organization App should be synced first. So it will again add

To restore the hidden SSO configurations to this child AWS app, sync the Parent AWS Organizations App.

Refer AWS - Hidden SSO configurations for more details.

Info

Notes:
To sync all S3 buckets data, Zilla requires the following permissions to be allowed in the Zilla IAM Reader role:

ListAllMyBuckets
GetBucketLocation
GetBucketPolicy
GetBucketAcl
GetBucketPublicAccessBlock
GetBucketOwnershipControls
GetBucketPolicyStatus
GetEncryptionConfiguration
ListAccessPoints
GetAccessPoint
GetAccessPointPolicy
GetAccessPointPolicyStatus

Set up AWS Application Integration on Zilla

Login to Zilla at http://app.zillasecurity.com/.
Image Modified
Once you are signed in, you will land on the Applications page.
Image Modified
Click Add Application. You will see a library of all applications listed which are supported by Zilla.
Image Modified
Type “aws” into the search bar to filter the results.
Image Modified
Click on Add to Applications next to the Amazon Web Services entry. You will see a dialog box appear.
All the fields are optional. Click Add to Applications.
Image Modified
You will be redirected back to the Applications page and you will see the Amazon Web Services entry included in the list.
Image Modified
Click the application instance to configure its integration.
Image Modified
Click Sync

...

now in the top right corner. You will see a dialog box appear.
Image Modified
Click the slider under API Integration to enable.
Image Modified
Enter the Role ARN. For

...

example: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role created above. and click Next.
Image Modified
Click Next again.
Image Modified
Your sync will begin. Once it completes, you will see the below message.
Image Modified
Click Done . You will then see a message like this if the sync completed successfully.
Image Modified
You can close the message dialog and navigate to the Accounts tab to the IAM Users from your AWS account.
Image Modified
Next, click the Permissions tab to browse the permissions assigned to each user.
Image Modified
Click the Resources tab to browse the AWS resources (S3 Buckets and S3 Access points).
Image Added
Click the Profile tab to browse the AWS account Security Settings.