This page outlines the steps to enable AWS Integration with Zilla. We will be using the Delegate access across AWS accounts using IAM roles tutorial as a guide to allow you to delegate access of your AWS account to Zilla’s AWS account using AWS IAM Roles.
| Table of Contents | ||||||
|---|---|---|---|---|---|---|
|
Bring in IAM Users and Groups into Zilla
To bring in IAM Users and Groups of an AWS Account, you need to create an IAM Role and attach an IAM Policy to it.
Create an IAM Policy for IAM Users and Groups
Steps to create an IAM Policy
...
Login to the AWS Account via the AWS Management Console
...
Enter your 12-digit account number. Click Next and then enter your username and password to login.
...
Once you are logged in, you will land on the home page with a search bar at the top.
...
...
In the search bar, search for IAM and click on the search result called IAM.
...
...
You will be redirected to the IAM dashboard.
...
...
Before creating a role, we will first create a policy that will be assigned to the role. Click Policies on the left hand side menu.
...
...
.
...
The
...
| Code Block |
|---|
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iam:GetGroup",
"Resource": "arn:aws:iam::<YOUR_AWS_ACCOUNt_ID>:group/*"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": "iam:GetAccountAuthorizationDetails",
"Resource": "*"
}
]
} |
...
...
Optionally add tags and click Next: Review.
...
Review Policy: On the review page, enter the Name (Zilla-IAM-Reader-Policy) and optionally a description for the policy. Review the permissions assigned to the policy and then click Create policy The policy will look like this:
...
...
You will see a success message that the policy has been created.
...
...
To confirm that the policy is present, you can search for it in the policy search bar. You will see your newly added policy in the list.
...
...
Click on the policy Zilla-IAM-Reader-Policy to double check the assigned permissions. The policy will look like this:
...
Click on the {} JSON tab to double check the policy json. (Account ID redacted from screenshot)
...
Now that you have created the policy, the next step is to create a cross account Role.
Create an IAM Role for IAM Users and Groups
Steps to create an IAM Role
Click on
Rolesfrom the left hand side menu to begin then clickCreate rolebutton to create a new IAM Role.
Under
Select type of trusted entityselectAnother AWS accountand enter the 12 digit Account ID of Zilla (087210011007). ClickNext: Permissions.
On the permissions page, search for the policy created ,
Zilla-IAM-Reader-Policy, and select the checkbox. ClickNext: Tags.
Optionally add tags and click
Next: Review.
On the review page, add the name of the role
Zilla-IAM-Reader-Roleand optionally add a description. Review the trusted entity account id matches Zilla’s account Id (087210011007) and that thePoliciessection containsZilla-IAM-Reader-Policy. ClickCreate role.
Once the role is created, you can search for it on the roles tab and click on the role to check its details.
On the role details page, double check the policy under
PermissionsandTrusted entitieshas Zilla Account ID (087210011007) underTrust relationships.
| Info |
|---|
Notes:
|
| Include Page | ||||
|---|---|---|---|---|
|
Bring SSO Users, Groups and Permission Sets into Zilla
...
To Bring the SSO users, Groups and Permission
...
Steps to create an IAM Policy
Click on
Policieson the left hand side menu of the IAM Dashboard.
Click
Create policyand click on theJSONtab.
IAM Policy Creation: Enter the following
jsonsnippet and clickNext: Tags. The following policy allows Zilla to read the SSO Users, Groups and Permission Sets information from your AWS accountCode Block { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "sso:ListAccountAssignments", "sso:ListPermissionSetsProvisionedToAccount", "sso:DescribePermissionSet" ], "Resource": [ "arn:aws:sso:::instance/*", "arn:aws:sso:::permissionSet/*/*", "arn:aws:sso:::account/*" ] }, { "Sid": "VisualEditor1", "Effect": "Allow", "Action": [ "identitystore:DescribeUser", "identitystore:DescribeGroup" ], "Resource": "*" } ] }
Optionally add tags and click
Next: Review.
Review Policy: On the review page, enter the Name (
Zilla-SSO-Reader-Policy) and optionally a description for the policy. Review the permissions assigned to the policy and then clickCreate policy. The policy will look like this:
You will see a success message like this:
To confirm that the policy is present, you can search for it in the policy search bar. You will see your newly added policy in the list.
Click the policy
Zilla-SSO-Reader-Policyto double check the assigned permissions. The policy will look like this:
Click on the
{} JSONtab to double check the policy json.
Now that you have created the policy, the next step is to create a cross account Role.
Create an IAM Role for SSO Users, Groups and Permission Set
Steps to create an IAM Role
Click
Rolesfrom the left hand side menu to begin.Click
Create rolebutton to create a new IAM Role. UnderSelect type of trusted entityselectAnother AWS accountand enter the 12 digit Account ID of Zilla (087210011007) and then clickNext: Permissions.On the permissions page, search for the policy created ,
Zilla-SSO-Reader-Policy, and select the checkbox. Then clickNext: Tags.
Optionally add tags and click
Next: Review.On the review page, add the name of the role
Zilla-SSO-Reader-Roleand optionally add a description. Review the trusted entity account id matches Zilla’s account Id (087210011007) and that thePoliciessection containsZilla-SSO-Reader-Policy, then clickCreate role.
Once the role is created, you can search for it on the roles tab and click on the role to check its details.
On the role details page, double check the policy under
PermissionsandTrusted entitieshas Zilla Account ID (087210011007) underTrust relationships.
| Info |
|---|
Notes:
|
Things to keep handy
...
For IAM Users and Groups: Copy the Role ARN. For eg: arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Role created above.
...
For SSO Users and Groups:, you need to keep the following things handy:
Copy the SSO Role ARN of your Master AWS Account. For eg:
arn:aws:iam::<YOUR_AWS_SSO_MASTER_ACCOUNT_ID>:role/Zilla-SSO-Reader-Rolecreated aboveARN of the SSO Instance
Identity Store Id of the Identity Provider of SSO Instance
12 digit Account ID of the AWS Instance for which you want to bring in SSO Users and Groups
AWS Region under which AWS SSO is setup
AWS SCIM Endpoint
AWS SCIM Access Token
Here are the instructions to get the above details:
...
In the search bar at the top, search for AWS SSO and click on the search result called AWS Single Sign-On as shown below.
...
...
You will land on the AWS SSO dashboard.
...
...
Click the Settings option on the left menu.
...
...
Copy the ARN of the SSO Instance and keep it handy. It will look something like this: arn:aws:sso:::instance/ssoins-<SOME_ALPHANUMERIC_ID>.
...
Also, copy the Identity store ID. It will look something like this: d-<SOME_NUMBERS> .
...
Next, click the AWS accounts option from the left menu.
...
...
Copy the 12 digit Account Id of the AWS Account whose Permission sets assignments you want to get.
...
Copy the region in which the AWS SSO Organization has been created. For eg: us-east-1.
...
...
Go back to Settings to get the Automatic Provisioning (SCIM) details
...
You can only get the SCIM details if Automatic Provisioning is enabled. You can choose to keep Automatic Provisioning disabled or choose to enable at this point. If Automatic Provisioning is disabled, Zilla won’t be able to track the Active Status of a user.
...
To enable Automatic Provisioning, click Enable automatic provisioning.
...
Copy the SCIM Endpoint and keep it handy.
Click Show token and copy the token. Note that this token is available to be copied only once.
...
sets into an AWS app instance in Zilla, this AWS app instance must have AWS Organization app instance as Parent Application.
...
Follow the steps here for AWS Organization Sync for this AWS app instance’s Parent Application.
| Info |
|---|
Notes:
Refer AWS - Hidden SSO configurations for more details. |
| Info |
|---|
Notes:
|
Set up AWS Application Integration on Zilla
Login to Zilla at http://app.zillasecurity.com/.
Once you are signed in, you will land on the
Applicationspage.
Click
Add Application. You will see a library of all applications listed which are supported by Zilla.
Type “aws” into the search bar to filter the results.
Click on
Add to Applicationsnext to theAmazon Web Servicesentry. You will see a dialog box appear.
...
All the fields are optional. Click
Add to Applications.
You will be redirected back to the Applications page and you will see the
Amazon Web Servicesentry included in the list.
...
Click the application instance to configure its integration.
...
Click
...
Sync
...
nowin the top right corner. You will see a dialog box appear.
Click
...
the
...
slider under API Integration to enable
...
.
...
Enter the Role ARN. For example:
arn:aws:iam::<YOUR_AWS_ACCOUNT_ID>:role/Zilla-IAM-Reader-Rolecreated above. and clickNext.
Click
Nextagain.
Your sync will begin. Once it completes, you will see the below message.
Click
Done. You will then see a message like this if the sync completed successfully.
You can close the message dialog and navigate to the Accounts tab to the IAM Users from your AWS account.
Next, click the Permissions tab to browse the
...
permissions assigned to each user.
Click the Resources tab to browse the AWS resources (S3 Buckets and S3 Access points).
Click the Profile tab to browse the AWS account Security Settings.
...
| Include Page | ||||
|---|---|---|---|---|
|