Amazon Web Services (AWS) | Scan Requirements

[ Applies to ] StorageGuard 9.x and later   /   Amazon Web Services (AWS) accounts   /   AWS IAM

StorageGuard collects configuration data from an AWS environment by running read-only AWS SDK management API calls. This article describes the requirements and how to set up an IAM user with read-only access for the scan.

Requirements

Set up IAM access for the scan

The following procedures are a suggested way to give StorageGuard read-only access. Do them in order, in the IAM service of the AWS Management Console (on the Console Home page, select IAM).

1. Create a read-only policy

1. In the navigation pane, select Policies, and then select Create policy.
2. On the first page, set the following:
   • Under Service, choose a service to grant access to, for example S3.
   • Under Actions, select the List and Read access levels.
   • Under Resources, enter a specific resource ARN, or select All resources.
3. Select Next: Tags, and then Next: Review.
4. Under Review policy, enter a Name for the policy.
5. Select Create policy.

2. Create a user group

1. In the navigation pane, select User groups, and then select Create group.
2. Under User group name, enter a name for the group.
3. Scroll to the bottom of the page, and select Create group.

3. Attach the policy to the group

1. In the navigation pane, select User groups, and then select the group you created.
2. Select the Permissions tab.
3. Under Permissions policies, select Add permissions > Attach policies.
4. Under Other permission policies, search for the policy you created, and select the check box next to it.
5. Scroll down, and select Add permissions.

4. Create the IAM user

1. In the navigation pane, select Users, and then select Add users.
2. On the Specify user details page, enter a User name, and select Next.
3. On the Set permissions page, select Next. You add permissions through the group in the next procedure.
4. Select Create user.

5. Add the user to the group

1. In the navigation pane, select User groups, and then select the group you created.
2. On the Users tab, under Users in this group, select Add users.
3. Search for the user you created, and select the check box next to it.
4. Select Add users.

6. Create an access key

1. In the navigation pane, select Users, and then select the user you created.
2. On the Security credentials tab, under Access keys, select Create access key.
3. On the Access key best practices & alternatives page, select Next.
4. On the Set description tag page, select Create access key.
5. On the Retrieve access keys page, copy the Access key and Secret access key, and store them securely.
6. Select Done.