Onboard AWS Accounts and Organizations with Temporary Delegation

After Cloud Security (InsightCloudSec) is deployed, you’re ready to start harvesting data from AWS, which requires securely connecting your Amazon Web Services (AWS)  Accounts and Organizations to the Rapid7 Command Platform.

As visibility into your cloud accounts improves and your inventory grows, you can then begin to leverage the rest of Cloud Security (InsightCloudSec), including Insights, Bots, Layered Context, and more.

You can use the AWS IAM temporary delegation feature  to allow Rapid7 temporary access to your AWS environment. The temporary delegation capability allows you to maintain control and visibility over the onboarding process using time-bound credentials with delineated permissions.

After you approve a temporary delegation request, Rapid7 will then deploy a CloudFormation template, which will provision the necessary AWS resources required for Rapid7 to collect data from your unique environment, including a custom AWS role used for harvesting. If you would prefer an alternative onboarding method, see the AWS Overview.

Prerequisites

• Access to the target AWS Account or Organization

Connect an account or organization

The IAM temporary delegation connection process involves configuring and sending a delegation request.

To configure and send a delegation request:

1. Log in to the AWS console  for the target account.
2. In a separate browser tab, log in to the Command Platform .
3. Go to Data Connectors > Cloud Accounts.
4. Open the Add Cloud interface:
   • First-time users:
     1. Click Onboard a Cloud Account.
     2. Select Amazon Web Services, then click Next.
     3. Select Yes, then click Next.
     4. Select AWS IAM Temporary Delegation, then click Next.
   • Returning users:
     1. Click + Add Cloud.
     2. Click Amazon Web Services.
     3. Click AWS IAM Temporary Delegation.
5. Enter a Nickname for the AWS account. This is a unique value that can be used to search and filter across Cloud Security (InsightCloudSec).
6. Indicate if you are adding an AWS Organization or an individual AWS Account.
7. Select the checkbox to acknowledge that Rapid7 will assume a temporary AWS role on your behalf to complete the onboarding process.
8. Enter the AWS Account ID for the individual Account or root Account for the Organization.
9. Enter an IAM Role name to associate with the onboarding process.
10. Click Send Delegation Request. An AWS window opens.
11. Optionally, click View JSON to review the policy that Rapid7 will use.
12. Review the delegation request:
    • AWS Delegation Admin users:
      1. Click Allow access to approve the request.
    • Other users:
      1. Click Request approval.
      2. Share the Request link and ID with someone in your Organization with the proper permissions to approve the request.

If the request is approved, Rapid7 will automatically set up the account and add it to Cloud Security (InsightCloudSec). You can find the account on the Clouds Listing page.