---
title: "AWS integration"
description: "Detect and sync nodes from your AWS accounts."
product: "Guardian"
edition: "Classic"
type: "workflow"
url: "https://docs.cloudhouse.com/guardian/classic/control/integrations/aws-integration/"
---
# AWS integration

An Amazon Web Services (AWS) integration with Guardian allows you to automatically sync and detect nodes from your AWS instance(s) to be added to Guardian for monitoring and evaluation.

Applies to: `Guardian Classic`

## Dependencies

To add an AWS integration, you need the following:

- An AWS account.
- One or more of the following services enabled within your AWS instance:

    - Auto Scaling Groups.
    - CloudFormation.
    - CloudTrails.
    - CloudWatch.
    - Config Services.
    - EBS Volumes.
    - EC2 Instances.
    - Access Analyser.
    - IAM Access Analysers.
    - IAM Account.
    - Key Management Services.
    - Lambda Functions.
    - Load Balancers.
    - Load Balancers V2.
    - RDS Instances.
    - S3 Buckets.
    - Security Groups.
    - VPCs.
    - VPC Flow Logs.
    - VPC Subnets.

- Security Group Permissions – Required for each of the above service(s) you plan to add to Guardian for monitoring. For more information, see [Security Group Permissions](#security-group-permissions).

## Add an AWS integration

Integrating AWS with Guardian establishes a seamless connection to streamline the process of syncing and monitoring your AWS nodes, ensuring they are efficiently scanned in Guardian.

To add an AWS integration to Guardian, complete the following:

1. In the Guardian web application, navigate to the **Integrations** tab (**Control** > **Integrations**) and click **Add Integration**. The **Add Integration** page is displayed.

    ![Addinteg](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/integrations/addinteg.png)

2. Select **AWS** from the list of available integrations. Here, you are required to complete the following options:

    ![Aws integration](https://docs.cloudhouse.com/guardian/classic/assets/images/guardian/control/integrations/aws-integration.png)

    **Name** field
    :   The display name for the integration within Guardian. This name is how you will identify the integration among all others configured in your Guardian instance, so ensure it is descriptive.

**Connection Manager Group** drop-down list
:   The Connection Manager group that is responsible for scanning and retrieving your AWS node(s). Select a Connection Manager group from the drop-down list.

**AWS Access Key** field
:   The unique IAM account identifier. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md).

**AWS Secret Key** field
:   The secret access key that is required to sign the request. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md).

**AWS IAM Role ARN (Optional)** field
:   The Amazon resource name that specifies the role of the IAM account holder. For more information on how to source this, see [AWS Scan User Account](https://docs.cloudhouse.com/guardian/classic/inventory/add-nodes/account-setup/aws-scan-user-account/index.md).

**AWS Regions (Optional)** field
:   The region your AWS account is using. This is displayed in your AWS Console login URL. For example, 'https://console.aws.amazon.com/console/home?region=**us-west-1**'.

**Enable Multi-Account Detection** field
:   Option to enable multi-account detection. If selected, discovery across multiple accounts using one set of credentials is enabled. For more information on how to source this, contact your Cloudhouse Representative.

**Check Things You Want To Detect** checkboxes
:   The option(s) you want to add to Guardian for monitoring. Select the checkbox(es) you want to detect. For example, ‘Auto Scaling Groups’.  Selecting a checkbox displays the following detection options:

    - **Ignore [Node Type] Nodes** – Option to ignore specific nodes from scans. Enter regular expression (**RegEx**) tags in the **[Node Type] Ignore Tags** field. Nodes containing these tags will not be included during scans.

        !!! note

            The **Negate [Node Type] Ignore Tags** checkbox reverses the detection rules you've set. If selected, the nodes containing the tags you entered will be the only ones included for detection.

    - **Remove [Node Type] Nodes** – Option to remove specific nodes when they are no longer detected. Enter RegEx tags in the **[Node Type] Remove Tags** field. Nodes containing these tags will be removed if they are not detected during a scan.

        !!! note

            The **Negate [Node Type] Remove Tags** checkbox reverses the detection rules you've set. If selected, the nodes that don't contain the tags you entered will be removed and the only nodes included for detection will be the ones that contain the tags.

    - **Allow Existing [Node Type] Nodes to Be Removed** – Option to change the standard behaviour of ignoring nodes with tags. Normally, if a node is ignored due to the tags, nodes can't be removed. However, selecting the **Allow Existing [Node Type] Nodes to Be Removed** checkbox lets you remove previously ignored nodes later when they are no longer detected, despite the ignore detection rule.

        !!! tip

            The **Allow Existing [Node Type] Nodes to Be Removed** checkbox was removed in V4.3.51.0 of Guardian. For more information, see [January 2025 Quarterly Release](https://docs.cloudhouse.com/guardian/classic/what-s-new/2-previous-release/2025/quarterly/q1/january-2025/index.md).

        !!! note

            If the **EC2 Instances** checkbox is selected from the list of **Check Things You Want To Detect** checkboxes, additional fields are displayed to allow you to configure what aspects of the EC2 instance to import to Guardian. For more information on how to configure these settings, see [EC2 Instances](https://docs.cloudhouse.com/guardian/classic/control/integrations/ec2-instances/index.md).

**Ignore Ephemeral Nodes** checkbox
:   Option to ignore ephemeral nodes. If selected, ephemeral nodes are not imported and not included in node scans.

**Remove Ephemeral Nodes** checkbox
:   Option to remove ephemeral nodes. If selected, ephemeral nodes are removed from the Guardian import list.

**Automatically start monitoring and scanning newly detected nodes** checkbox
:   Option to automatically start monitoring and scanning your nodes once the AWS integration has been created. If selected, the imported nodes are automatically added to the **Monitored** tab (**Inventory** > **Monitored**) for regular scanning. Here, you can apply policies, create node groups, and schedule regular scans. For more information, see [Monitored Nodes](https://docs.cloudhouse.com/guardian/classic/inventory/monitored/monitored/index.md).

    If not selected, the nodes are added to the Detected tab (Inventory > Detected) for processing. To monitor the detected nodes, you must move them to the Monitored tab. For more information, see

    [Detected Nodes](https://docs.cloudhouse.com/guardian/classic/inventory/detected/detected/index.md).

3. Once you have set the correct values for each of the options displayed, click **Done** to create the AWS integration.

If successful, a confirmation message is displayed and the AWS integration is added to the **Integrations** tab of your Guardian instance. If unsuccessful, an error message is displayed. Use the information displayed in the error message(s) to troubleshoot the values in your **AWS Integration** options.

## Integration outcomes

When integrating AWS with Guardian, the following outcomes are expected:

- The integration stores the credentials that you supply to Guardian securely, within the database.
- An automatic synchronisation (between Guardian and AWS) occurs every two hours. For more information on how to alter this interval, see [Job Schedule](https://docs.cloudhouse.com/guardian/classic/control/job-schedule/job-schedule/index.md) (**Control** > **Job Schedule**).
- The sync event calls out to AWS using the supplied credentials to return a list of detected nodes and their corresponding details.
- By default, any nodes that Guardian detects within your AWS instance are automatically stored within the **Detected** tab for processing.
- Alternatively, if the **Automatically start monitoring and scanning newly detected nodes** checkbox is selected, the detected nodes are added to the **Monitored** tab instead.

## Troubleshooting

If you are experiencing issues with your integration, try the following:

- Verify that the account credentials supplied for the integration are correct.
- Depending on how the integration was configured, the synced nodes are either displayed on the **Detected** tab or the **Monitored** tab.
- To confirm the status of the integration sync, check the integration sync event in the **Events** tab (**Control** > **Events**) of your Guardian instance. For more information, see [Events](https://docs.cloudhouse.com/guardian/classic/control/events/events/index.md).

## Security group permissions

When setting up an AWS integration, the following security group permissions are required, in order to sync and scan nodes from the corresponding service(s):

| Service | Permissions |
| --- | --- |
| Auto Scaling Groups | ``` autoscaling:DescribeAutoScalingGroups ``` |
| CloudFormation | ``` cloudformation:DescribeStacks ```  ``` cloudformation:GetTemplate ```  ``` cloudformation:GetTemplateSummary ```  ``` cloudformation:ListStackInstances ```  ``` cloudformation:ListStacks ```  ``` cloudformation:ListStackSets ``` |
| CloudTrails | ``` cloudtrail:DescribeTrails ```  ``` cloudtrail:GetEventSelectors ```  ``` cloudtrail:GetTrailStatus ```  ``` cloudtrail:ListPublicKeys ```  ``` cloudtrail:ListTrails ```  ``` s3:GetBucketLogging ```  ``` s3:GetBucketPolicy ``` |
| CloudWatch | ``` cloudwatch:DescribeAlarms ```  ``` cloudwatch:ListDashboards ```  ``` cloudwatch:ListTagsForResource ```  ``` events:ListEventBuses ```  ``` events:ListRules ```  ``` logs:DescribeLogGroups ``` |
| Config Services | ``` config:DescribeConfigurationRecorders ``` |
| EBS Volumes | ``` ec2:DescribeVolumes ``` |
| EC2 Instances | ``` ec2:DescribeInstances ```  ``` ec2:DescribeRouteTables ```  ``` ec2:DescribeSubnets ``` |
| IAM Access Analysers | ``` access-analyzer:ListAnalyzers ```  ``` access-analyzer:ListPolicyGenerations ```  ``` access-analyzer:ListTagsForResource ``` |
| IAM Account | ``` iam:GenerateCredentialReport ```  ``` iam:GetAccessKeyLastUsed ```  ``` iam:GetAccountPasswordPolicy ```  ``` iam:GetAccountSummary ```  ``` iam:GetCredentialReport ```  ``` iam:GetGroupPolicy ```  ``` iam:GetPolicyVersion ```  ``` iam:GetRolePolicy ```  ``` iam:GetUserPolicy ```  ``` iam:ListAccessKeys ```  ``` iam:ListAttachedGroupPolicies ```  ``` iam:ListAttachedRolePolicies ```  ``` iam:ListAttachedUserPolicies ```  ``` iam:ListGroupPolicies ```  ``` iam:ListGroups ```  ``` iam:ListGroupsForUser ```  ``` iam:ListMFADevices ```  ``` iam:ListPolicies ```  ``` iam:ListRolePolicies ```  ``` iam:ListRoles ```  ``` iam:ListServerCertificates ```  ``` iam:ListUserPolicies ```  ``` iam:ListUsers ```  ``` iam:ListUserTags ```  ``` iam:ListVirtualMFADevices ``` |
| Key Management Service | ``` kms:DescribeKey ```  ``` kms:GetKeyRotationStatus ```  ``` kms:ListAliases ```  ``` kms:ListResourceTags ``` |
| Lambda Functions | ``` lambda:GetFunction ```  ``` lambda:GetPolicy ```  ``` lambda:ListFunctionEventInvokeConfigs ```  ``` lambda:ListProvisionedConcurrencyConfigs ```  ``` lambda:ListTags ``` |
| Load Balancers | ``` elasticloadbalancing:DescribeListeners ```  ``` elasticloadbalancing:DescribeLoadBalancers	 ```  ``` elasticloadbalancing:DescribeLoadBalancerAttributes ```  ``` elasticloadbalancing:DescribeLoadBalancerPolicies ```  ``` elasticloadbalancing:DescribeLoadBalancerPolicyTypes ```  ``` elasticloadbalancing:DescribeSSLPolicies ```  ``` elasticloadbalancing:DescribeTags ``` |
| Load Balancers V2 | ``` elasticloadbalancing:DescribeListeners ```  ``` elasticloadbalancing:DescribeLoadBalancers ```  ``` elasticloadbalancing:DescribeLoadBalancerAttributes ```  ``` elasticloadbalancing:DescribeLoadBalancerPolicies ```  ``` elasticloadbalancing:DescribeLoadBalancerPolicyTypes ```  ``` elasticloadbalancing:DescribeSSLPolicies ```  ``` elasticloadbalancing:DescribeTags ``` |
| RDS Instances | ``` rds:DescribeDBInstances ```  ``` rds:ListTagsForResource ``` |
| S3 Buckets | ``` s3:GetBucketAcl, s3:GetBucketCORS ```  ``` s3:GetBucketEncryption ```  ``` s3:GetBucketEncryptionConfiguration ```  ``` s3:GetBucketLocation ```  ``` s3:GetBucketLogging ```  ``` s3:GetBucketPolicy ```  ``` s3:GetBucketPublicAccessBlock ```  ``` s3:GetBucketReplication ```  ``` s3:GetBucketTagging ```  ``` s3:GetBucketVersioning ```  ``` s3:GetObjectAcl ```  ``` s3:ListAllMyBuckets ``` |
| Security Groups | ``` ec2:DescribeSecurityGroups ``` |
| VPCs | ``` ec2:DescribeNetworkAcls ```  ``` ec2:DescribeVpcAttribute ```  ``` ec2:DescribeVpcs ``` |
| VPS Flow Logs | ``` ec2:DescribeFlowLogs ``` |
| VPC Subnets | ``` ec2:DescribeSubnets ``` |