This page outlines the steps to enable AWS Integration with Zilla. We will be using the Delegate access across AWS accounts using IAM roles tutorial as a guide to allow you to delegate access of your AWS account to Zilla’s AWS account using AWS IAM Roles.
Create an IAM Role
Steps to create an IAM Role
...
Login to the AWS Account via the AWS Management Console
...
Enter your 12-digit account number. Click Next and then enter your username and password to login
...
Once you are logged in, you will land on the home page with a search bar on top
...
...
On the search bar on top, search for IAM and click on the search result called IAM as shown below
...
...
You will be redirected to the IAM dashboard
...
...
Before creating a role, we will first create a policy that will be assigned to the role. For that click on Policies on the left hand side menu.
...
...
Click on Create policy and click on the JSON tab
...
If you want to get just IAM users, enter the following json snippet and click on next. Replace <YOUR_AWS_ACCOUNT_ID> with your 12 digit AWS Account ID.
| Code Block | ||
|---|---|---|
| ||
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iam:GetGroup",
"Resource": "arn:aws:iam::<YOUR_AWS_ACCOUNt_ID>:group/*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "iam:GetAccountAuthorizationDetails",
"Resource": "*"
}
]
} |
...
For both SSO and IAM Users, enter the following and click on next. Replace <YOUR_AWS_ACCOUNT_ID> with your 12 digit AWS Account ID.
| Code Block |
|---|
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"sso:ListAccountAssignments",
"sso:ListPermissionSetsProvisionedToAccount",
"sso:DescribePermissionSet",
"iam:GetGroup"
],
"Resource": [
"arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:group/*",
"arn:aws:sso:::instance/*",
"arn:aws:sso:::permissionSet/*/*",
"arn:aws:sso:::account/*"
]
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"identitystore:DescribeUser",
"identitystore:DescribeGroup",
"iam:GetAccountAuthorizationDetails"
],
"Resource": "*"
}
]
} |
...
Optionally add tags and click next.
...
...
On the review page, enter the name (Zilla-IAM-Reader-Policy) and optionally a description for the policy. Review the permission assigned to the policy and then click on Create policy
...
...
You will a success message like this
...
...
To confirm that the policy is present, you can search for it in the policy search bar. You will see your newly added policy in the list.
...
...
Click on the policy Zilla-IAM-Reader-Policy to double check the assigned permissions
...
Click on the JSON tab to double check the policy json. (Account ID redacted from screenshot)
...
...
Now that you have created the desired policy, the next step is to create a cross account Role. Click on Roles from the left hand side menu to begin.
...
...
Click on Create Role button to create a new IAM Role. 1st step is to Select type of trusted entity Select Another AWS Account and enter the 12 digit Account ID of Zilla (087210011007) and then click on next.
...
...
On the permissions page, search for the policy we created Zilla-IAM-Reader-Policy and the select the checkbox. Then click next.
...
...
Optionally add tags. Click next.
...
...
On the review page, add the name of the role Zilla-IAM-Reader-Role and optionally add a description. Review the trusted entity account id matches Zilla’s account Id (087210011007) and that the policies has Zilla-IAM-Reader-Policy then click on Create role
...
Once the role is created, you can search for it on the roles tab and click on the role to check its details
...
On the role details page, double check the policy under permissions and trusted entity has Zilla Account ID (087210011007) under trusted relationships.
...
...
| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Bring in IAM Users and Groups into Zilla
To bring in IAM Users and Groups of an AWS Account, you need to create an IAM Role and attach an IAM Policy to it.
The next step is to create a cross account Role.
Create an IAM Role for IAM Users and Groups
| Include Page | ||||
|---|---|---|---|---|
|
Bring SSO Users, Groups and Permission Sets into Zilla
To Bring the SSO users, Groups and Permission sets into an AWS app instance in Zilla, this AWS app instance must have AWS Organization app instance as Parent Application.
...
Follow the steps here for AWS Organization Sync for this AWS app instance’s Parent Application.
| Info |
|---|
Notes:
Refer AWS - Hidden SSO configurations for more details. |
| Info |
|---|
Notes:
|
Set up AWS Application Integration on Zilla
...
Login to Zilla at http://app.zillasecurity.com/
...
.
Once you are signed in, you will land on the
...
Applicationspage.
Click
...
Add Application. You will see a library of all applications listed
...
which are supported by Zilla.
...
Type “aws” into the search bar
...
to filter the results.
Click on
Add
...
to Applicationsnext to theAmazon Web Servicesentry. You will see a dialog box appear.
...
All the fields are optional. Click
...
Add to Applications.
You will be redirected back to the Applications page and you will see the
Amazon Web Servicesentry included in
...
the list.
Click the application instance to configure its integration.
...
Click
...
Sync nowin the top right corner. You will see a dialog box appear.
...
Click
...
the slider under API Integration to enable
...
.
...
...
Enter the Role ARN. For example:
arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role
...
Optionally, for SSO, you can find the Identity Store Id and SSO Instance ARN under the AWS SSO Service. Account Id is the same as <YOUR_AWS_ACCOUNT_ID>
...
created above. and click
Next.
Click
Nextagain.
Your sync will
...
begin. Once it completes, you will see the below message.
Click
Done. You will then see a message like this if the sync completed successfully.
...
You can close the message dialog and navigate to the Accounts tab to the IAM Users from your AWS account.
Next, click
...
the
...
Permissions tab to browse the
...
permissions assigned to each user.
Click the Resources tab to browse the AWS resources (S3 Buckets and S3 Access points).
Click the Profile tab to browse the AWS account Security Settings.
...
| Include Page | ||||
|---|---|---|---|---|
|
...