AWS IAM User

Creating an IAM User using the AWS Console

1. In the AWS console, use the Search bar to navigate to the IAM dashboard within the AWS Management Console. Type IAM and click on the IAM service.

2. From the IAM dashboard, in the left-hand navigation bar, under Access management, select Users.

3. Create a user with Create user.

4. In the Specify user details screen, give the user a meaningful name. Secberus will use this user's access key, there is no need provide console access to this user. Click Next.

5. In the Set permissions screen, under Permission options select the Attach policies directly option.
6. Under Permission policies, click Create policy. This will open a new window.
7. In the Specify permissions screen, within the Policy editor, click on JSON. Copy the following JSON policy and paste it in the editor.

JSON

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "apigateway:GET",
                "cloudfront:DescribeFunction",
                "ec2:GetEbsDefaultKmsKeyId",
                "ecr:DescribePullThroughCacheRules",
                "elasticmapreduce:ListReleaseLabels",
                "elasticmapreduce:ListStudios",
                "elasticmapreduce:ListSupportedInstanceTypes",
                "es:ListElasticsearchInstanceTypes",
                "es:ListVpcEndpoints",
                "lambda:GetCodeSigningConfig",
                "lambda:GetFunction",
                "lambda:GetFunctionCodeSigningConfig",
                "lambda:GetRuntimeManagementConfig",
                "lambda:ListAliases",
                "lambda:ListEventSourceMappings",
                "lambda:ListFunctionEventInvokeConfigs",
                "lambda:ListFunctions",
                "lambda:ListLayers",
                "lambda:ListLayerVersions",
                "lambda:ListProvisionedConcurrencyConfigs",
                "lambda:ListVersionsByFunction",
                "organizations:ListAccounts",
                "organizations:ListRoots",
                "organizations:ListPolicies",
                "organizations:ListDelegatedAdministrators",
                "s3:ListBucket",
                "sns:GetSubscriptionAttributes",
                "waf:ListRuleGroups",
                "waf:ListRules",
                "waf:ListSubscribedRuleGroups",
                "waf-regional:ListRateBasedRules",
                "waf-regional:ListRuleGroups",
                "waf-regional:ListRules",
                "wafv2:DescribeManagedRuleGroup"
            ],
            "Resource": "*"
        }
    ]
}

8. Click Next.
9. In the Review and create screen, give the policy a meaningful name and click on Create policy.
10. Once the policy is created, go back to the Create user tab. Within Permission policies, click on refresh so the newly created policy will show up in the list.
11. Search for and select the following policies:
    • SecurityAudit,
    • AWSCloudTrail_ReadOnlyAccess, and
    • the policy created in step 6
12. Click Next.
13. In the Review and create screen, click Create user.
14. After the user is created, click on the user. Click on the Security credentials tab and then click Create access key.

15. In the Access key best practices & alternatives screen, select the Third-party service use case. Click on the confirmation check box and click Next.

16. Give an optional description, click on Create access key.
17. In the Retrieve access keys screen, take note of the Access key and Secret access key. These will be needed when creating the AWS datasource within Secberus.

Secberus - Connect AWS Datasource

1. Log into Secberus and select the org you want to create the datasource connection in.
2. Click onSettings and then click on Data sources.
3. Choose the AWS data source type in the Add new data source section.

4. Populate the Name field, select the appropriate Regions, and choose Using IAM user credentials as the Authentication method. Then copy the credentials you saved from step 15 into the Access key ID and Secret access key fields.

5. With the credentials in place, click the Connect button to initialize your data source.

👍

CONGRATULATIONS 🎉

You successfully onboarded an AWS account. You can add more AWS accounts, onboard other cloud provider accounts, or apply a policy to this AWS account. Additionally, you can view the connection status once Secberus begins collecting resource data for evaluation.