AWS#
Connect an AWS account and Guardian discovers its EC2, ECS, EKS and RDS resources and adds them as CIs, so you don't add them one by one.
Start from Bulk import from AWS when adding CIs, or from Integrations.
Give Guardian access#
Guardian needs read access to the account. Configure AWS Integration shows the steps in the AWS Console, and the IAM policy document to paste. Choose one way to authenticate:
- IAM role
- Create a role Guardian can assume, and give Guardian its IAM Role ARN.
- Access keys
- Create an IAM user with programmatic access only (no console access is needed), attach the policy, and create an access key for an Application running outside AWS. Give Guardian the Access Key ID and Secret Access Key. AWS shows the secret only once, so copy it straight away.
Test the connection#
Enter your AWS Account ID, choose at least one region, and test. Guardian checks it can reach the AWS API, verifies the role or keys, and checks the IAM permissions. It won't continue until the test passes.
Choose what to scan#
Choose the resources Guardian scans, then finish. Guardian discovers them and adds them to All CIs.
Afterwards#
Manage the integration from Integrations: start a sync, change What Guardian scans, or delete it.
Good to know
Guardian stores the secret access key encrypted and can't read it back, so it can't re-test access keys after the integration is created. To change keys, delete the integration and connect again.