AWS Integration Setup Guide

Complete guide for integrating AWS with CyberOptix using cross-account IAM roles.

Overview

CyberOptix uses a cross-account IAM role with read-only permissions to discover and monitor AWS resources across your organization. This guide walks through creating the necessary IAM policies, service account, and role configuration.

Prerequisites

• Access to AWS Management Console
• IAM permissions to create users, roles, and policies
• AWS Organizations access (if integrating multiple accounts)

Part 1: Create IAM Policies

Step 1: Navigate to IAM

1. Open AWS Console → Security, Identity, & Compliance → IAM

Step 2: Create Read-Only Policy

1. Click Policies → Create policy
2. Select JSON tab
3. Paste the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "organizations:ListAccounts",
                "ec2:Describe*",
                "cloudwatch:List*",
                "cloudwatch:Get*",
                "ssm:Describe*",
                "ssm:Get*",
                "ssm:List*"
            ],
            "Resource": "*"
        }
    ]
}

4. Click Next
5. Name the policy: cyberoptix-readonly-policy
6. Click Create policy

Step 3: Create Assume Role Policy

1. Click Policies → Create policy
2. Select JSON tab
3. Paste the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRole",
            "Resource": "arn:aws:iam::*:role/CyberOptixReadOnlyAssumeRole"
        }
    ]
}

4. Click Next
5. Name the policy: cyberoptix-assume-role-policy
6. Click Create policy

Part 2: Create IAM Service Account

Step 1: Create User

1. Navigate to IAM → Users → Create user

2. Enter a username: cyberoptix-svc-account
3. Do NOT select "AWS Management Console access"
4. Click Next

Step 2: Attach Policies

1. Select Attach policies directly

2. Select both policies created in Part 1:
   • cyberoptix-readonly-policy
   • cyberoptix-assume-role-policy
3. Click Next → Create user

Step 3: Create Access Keys

1. Click on the newly created user
2. Navigate to Security credentials tab

3. Scroll to Access keys → Create access key

4. Select Application running outside AWS
5. Click Next

6. Add a description tag (optional)
7. Click Create access key
8. Save the Access Key ID and Secret Access Key - you'll need them in Part 4

Part 3: Configure Cross-Account Role (Multi-Account Setup)

Skip this section if you only have a single AWS account.

Repeat these steps in each AWS account you want to integrate with CyberOptix.

Step 1: Create IAM Role

1. Navigate to IAM → Roles → Create role
2. Select Custom trust policy

3. Paste the following trust policy (replace XXXXXXXXXXX with your management account ID):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::XXXXXXXXXXX:user/cyberoptix-svc-account"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

4. Click Next

Step 2: Attach AWS Managed Policies

1. Toggle the filter to All types
2. Select the following AWS managed policies:
   • ReadOnlyAccess
   • CloudWatchReadOnlyAccess
   • AmazonSSMReadOnlyAccess
3. Click Next

Step 3: Name the Role

1. Enter role name: CyberOptixReadOnlyAssumeRole
2. Click Create role

Important: The role name must be exactly CyberOptixReadOnlyAssumeRole to match the assume role policy created in Part 1.

Part 4: Add Integration to CyberOptix

Step 1: Navigate to Integrations

1. Log in to CyberOptix
2. Navigate to Integrations → Available Integrations

Step 2: Create AWS Integration

1. Select AWS as the integration type

2. Enter the credentials from Part 2, Step 3:
   • Access Key ID: From the service account access keys
   • Secret Access Key: From the service account access keys
   • AWS Assume Role: CyberOptixReadOnlyAssumeRole

Note: If the role is in a directory, include the full path (e.g., /path/CyberOptixReadOnlyAssumeRole)

3. Click Submit

Step 3: Verify Integration

The integration will appear in your Active Integrations list. CyberOptix will begin discovering AWS resources within a few minutes.

Permission Summary

IAM Service Account Policies

Cross-Account Role Permissions

What Data CyberOptix Collects

CyberOptix performs read-only operations on the following AWS resources:

Compute & Networking:

• EC2 instances, AMIs, snapshots, volumes
• VPCs, subnets, security groups, network interfaces
• Elastic Load Balancers, Auto Scaling Groups

Monitoring & Management:

• CloudWatch metrics, alarms, and logs
• Systems Manager parameters and patch compliance
• AWS Config rules and compliance status

Organization:

• AWS Organization accounts list
• Account metadata and structure

Additional Resources

• AWS IAM Best Practices
• AWS Cross-Account Access
• AWS Security Token Service