Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

In your AWS console, navigate to Services > IAM > Policies > Create policy.

Click on the JSON tab, to get an online editor.

Replace the default, empty JSON with the JSON below. The JSON contains several statements:

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Action":[
            "cloudtrail:DescribeTrails",
            "cloudtrail:LookupEvents",
            "iam:ListGroups",
            "iam:ListRoles",
            "iam:ListPolicies",
            "iam:ListUsers",
            "iam:ListAccountAliases",
            "iam:GetUser",
            "cloudwatch:DescribeAlarms",
            "cloudwatch:DescribeAlarmHistory",
            "guardduty:GetFindings",
            "guardduty:ListDetectors",
            "guardduty:ListFindings",
            "events:ListRules",
            "events:ListTargetsByRule",
            "redshift:DescribeEvents",
            "redshift:DescribeClusters",
            "redshift:DescribeLoggingStatus",
            "redshift:DescribeClusterParameters",
            "shield:ListAttacks",
            "shield:GetSubscriptionState",
            "inspector:ListFindings",
            "inspector:DescribeFindings",
            "inspector:ListAssessmentTemplates",
            "logs:DescribeLogGroups",
            "logs:CreateExportTask",
            "logs:DescribeExportTasks",
            "logs:CancelExportTask",
            "ec2:DescribeInstances",
            "ec2:DescribeRegions"
         ],
         "Resource":"*"
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:GetObject",
            "s3:GetBucketAcl",
            "s3:ListBucket"
         ],
         "Resource":[
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region1",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region2",
            "arn:aws:s3:::my-redshift-cluster1-db-audit-log-bucket",
            "arn:aws:s3:::my-redshift-cluster2-db-audit-log-bucket",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region1/*",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region2/*",
            "arn:aws:s3:::my-redshift-cluster1-db-audit-log-bucket/*",
            "arn:aws:s3:::my-redshift-cluster2-db-audit-log-bucket/*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "s3:DeleteObject"
         ],
         "Resource":[
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region1",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region2",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region1/*",
            "arn:aws:s3:::my-cloudwatch-logs-bucket-for-region2/*"
         ]
      },
      {
         "Effect":"Allow",
         "Action":[
            "sqs:DeleteMessage",
            "sqs:ReceiveMessage"
         ],
         "Resource":[
            "arn:aws:sqs:my-region:my-account-id:my-macie-sqs",
            "arn:aws:sqs:my-region:my-account-id:my-cloudtraildata-sqs"
         ]
      }
   ]
}

In your AWS console, navigate to Services > IAM > Users > Add user.

Give your user a unique name and enable Programmatic access:

Click Next: Permissions.

You are transferred to the Set permissions page.

(Basic authentication only) Choose Attach Existing Policies Directly and search for any policies you created.

Typically you will have one policy per cloud collector.

For STSAssumeRole authentication, skip this step.

Continue the user creation process (tags are optional) and finish the user creation.

When you are finished, click Next: Review and then Create user.

Record the Secret Access Key and Access Key ID. Optionally download the credentials in CSV format, as they will not be accessible after you leave this page.

In your AWS console, navigate to IAM > Roles > Create Role.

Enable the AWS Service and EC2 service and Click Next: Permissions.

This will create a Trust relationship that allows EC2 instances to call AWS services on your behalf. You will modify the Trust relationship later, per authentication method that you choose.

Search the policy created earlier and check its checkbox. Click Next: Tags.

Optionally add tags. Click Next: Review.

Give it a meaningful name, for example ExabeamCCAWSConnectorRole, and description. Click Create Role.

Search for the created role and click on it. Copy aside the role ARN.

Finalize AssumeRole and InstanceProfile authentication configuration.

Before you begin, make sure you review the Prerequisites to Configure the AWS Cloud Connector.

Log in to the Exabeam Cloud Connectors platform with your registered credentials.

Navigate to Settings > Accounts > Add Account.

Click Select Service to Add, then select AWS from the list.

In the Accounts section, enter the required information.

Choose the authentication method.

To confirm that the Exabeam Cloud Connector platform communicates with the service, click Test Connection.

Click Done to save your changes. The cloud connector is now set up on the Exabeam Cloud Connector platform.

To ensure that the connector is ready to send and collect data, Start the connector and check that the status shows OK.