Overview

Amazon Web Services (AWS) is an on-demand cloud computing platforms that provides various services related to networking, compute, storage, middleware, IOT and other processing capacity.

Available Integrations

The following AWS services can be integrated with the Sevco platform:

⚠️

Please review the configuration instructions in the section below before setting up permissions for apps.

Configuration

1. Choose an Access Schema: A schema is a configuration template that defines a specific way to connect, authenticate, and interact with a source. The following are the available schemas

   • API ID / API Secret Key: Will retrieve AWS objects using a generated access key ID and secret access key
   • AssumeRole: Will retrieve AWS objects by allowing Sevco to assume the specified role

2. Configure the Access Schema:

API ID / API Secret Key Schema

AssumeRole

3. Add new integration Select which integration(s) you wish to add. See links for details on additional configuration required.

   • Collect devices from EC2
   • Collect users from IAM
   • Collect users from Identity Center
   • Sync assets to an S3 bucket

4. Configure General Information: OPTIONAL: You can set the following fields to give platform configuration

5. Activate Config: To enable this configuration "Activate."

External Documentation

Creating credentials

Access Key ID/Secret Access Key Schemas

You'll be asked to provide source credentials that Sevco will use to connect to AWS EC2. The following link will step you through creating your AWS keys.
https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys

Assume Role Schemas

You'll be required to configure a AWS role for Sevco to assume to connect to AWS. Please contact Sevco Support for the full details on creating and configuring your AWS roles.

Create a new role that will be assumed by Sevco to interact with your AWS account. Use the following JSON to create your trust policy. Sevco Support will provide your sts:ExternalId to replace the 11111111-1111-1111-1111-111111111111 value and the Sevco account ID to replace 123456789010.

Sample EC2 Assume Role trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789010:role/Sevco_USProd_Ec2AssetCollection"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "11111111-1111-1111-1111-111111111111"
                }
            }
        }
    ]
}

Sample Users Assume Role trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789010:role/Sevco_USProd_IAMAssetCollection"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "11111111-1111-1111-1111-111111111111"
                }
            }
        }
    ]
}

Note: We use the Sevco_USProd_IAMAssetCollection principal for collection from both IAM and Identity Store

Sample S3 Sync Assume Role trust policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::123456789010:role/Sevco_USProd_S3InventorySync"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "11111111-1111-1111-1111-111111111111"
                }
            }
        }
    ]
}

AWS Organization Discovery

AWS Organization Discovery allows Sevco to discover all AWS accounts that are members of your AWS Organization. When enabled, Sevco will iterate through each member account and collect devices from EC2 or users from IAM as configured. At this time, user collection from Identity Center is not supported.

If organizational discovery is enabled the following additional configuration is required

• The integration needs to be configured to assume a role into the AWS account that owns your AWS Organization.
• A role of the same name with appropriate permissions for EC2 and/or IAM collection needs to be created in each member account in your Organization that you'd like to collect assets from.
• The role in the primary account will need an additional statement added to it's permissions document as show below

{
  "Effect": "Allow",
  "Action": [
    "organizations:ListAccounts"
  ],
  "Resource": "*"
}

Required permissions

See integration specific documentation for details

API Documentation

Contact Us

If you're having problems integrating a source, or if you've found something wrong in this document, please email us at [email protected] or suggest edits directly by selecting the Suggest Edits located in the upper right hand corner of the documentation.