Skip to content

Commit 44098c2

Browse files
liljack17liljack17
authored
Merge pull request #203267 from bmansheim/native-aws-connector
Make native connector primary option
2 parents 9d1c005 + db5e78d commit 44098c2

File tree

3 files changed

+93
-97
lines changed

3 files changed

+93
-97
lines changed

‎articles/defender-for-cloud/quickstart-onboard-aws.md

Lines changed: 67 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -8,20 +8,18 @@ ms.custom: mode-other
88
---
99
# Connect your AWS accounts to Microsoft Defender for Cloud
1010

11-
With cloud workloads commonly spanning multiple cloud platforms, cloud security services must do the same.
11+
With cloud workloads commonly spanning multiple cloud platforms, cloud security services must do the same. Microsoft Defender for Cloud protects workloads in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
1212

13-
Microsoft Defender for Cloud protects workloads in Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).
13+
To protect your AWS-based resources, you can connect an AWS account with either:
1414

15-
To protect your AWS-based resources, you can connect an account with one of two mechanisms:
15+
- **Native cloud connector** (recommended) - Provides an agentless connection to your AWS account that you can extend with Defender for Cloud's Defender plans to secure your AWS resources:
1616

17-
- **Classic cloud connectors experience** - As part of the initial multicloud offering, we introduced these cloud connectors as a way to connect your AWS and GCP projects. If you've already configured an AWS connector through the classic cloud connectors experience, we recommend deleting these connectors (as explained in [Remove classic connectors](#remove-classic-connectors)), and connecting the account again using the newer mechanism. If you don't do this before creating the new connector through the environment settings page, do so afterwards to avoid seeing duplicate recommendations.
17+
- [**Cloud Security Posture Management (CSPM)**](overview-page.md) assesses your AWS resources according to AWS-specific security recommendations and reflects your security posture in your secure score. The [asset inventory](asset-inventory.md) gives you one place to see all of your protected AWS resources. The [regulatory compliance dashboard](regulatory-compliance-dashboard.md) shows your compliance with built-in standards specific to AWS, including AWS CIS, AWS PCI DSS, and AWS Foundational Security Best Practices.
18+
- [**Microsoft Defender for Servers**](defender-for-servers-introduction.md) brings threat detection and advanced defenses to [supported Windows and Linux EC2 instances](supported-machines-endpoint-solutions-clouds-servers.md?tabs=tab/features-multicloud).
19+
- [**Microsoft Defender for Containers**](defender-for-containers-introduction.md) brings threat detection and advanced defenses to [supported Amazon EKS clusters](supported-machines-endpoint-solutions-clouds-containers.md).
20+
- [**Microsoft Defender for SQL**](defender-for-sql-introduction.md) brings threat detection and advanced defenses to your SQL Servers running on AWS EC2, AWS RDS Custom for SQL Server.
1821

19-
- **Environment settings page** (recommended) - This page provides a greatly improved, simpler, onboarding experience (including auto provisioning). This mechanism also extends Defender for Cloud's enhanced security features to your AWS resources:
20-
21-
- **Defender for Cloud's CSPM features** extend to your AWS resources. This agentless plan assesses your AWS resources according to AWS-specific security recommendations and these are included in your secure score. The resources will also be assessed for compliance with built-in standards specific to AWS (AWS CIS, AWS PCI DSS, and AWS Foundational Security Best Practices). Defender for Cloud's [asset inventory page](asset-inventory.md) is a multicloud enabled feature helping you manage your AWS resources alongside your Azure resources.
22-
- **Microsoft Defender for Containers** brings threat detection and advanced defenses to your Amazon EKS clusters. This plan includes Kubernetes threat protection, behavioral analytics, Kubernetes best practices, admission control recommendations and more. You can view the full list of available features in [Defender for Containers feature availability](supported-machines-endpoint-solutions-clouds-containers.md).
23-
- **Microsoft Defender for Servers** brings threat detection and advanced defenses to your Windows and Linux EC2 instances. This plan includes the integrated license for Microsoft Defender for Endpoint, security baselines and OS level assessments, vulnerability assessment scanning, adaptive application controls (AAC), file integrity monitoring (FIM), and more. You can view the full list of available features in the [feature availability table](supported-machines-endpoint-solutions-clouds-servers.md?tabs=tab/features-multicloud).
24-
- **Microsoft Defender for SQL** brings threat detection and advanced defenses to your SQL Servers running on AWS EC2, AWS RDS Custom for SQL Server. This plan includes the advanced threat protection and vulnerability assessment scanning. You can view the [full list of available features](defender-for-sql-introduction.md).
22+
- **Classic cloud connector** - Requires configuration in your AWS account to create a user that Defender for Cloud can use to connect to your AWS environment. If you have classic cloud connectors, we recommend that you [delete these connectors](#remove-classic-connectors) and use the native connector to reconnect to the account. Using both the classic and native connectors can produce duplicate recommendations.
2523

2624
For a reference list of all the recommendations Defender for Cloud can provide for AWS resources, see [Security recommendations for AWS resources - a reference guide](recommendations-reference-aws.md).
2725

@@ -32,7 +30,6 @@ This screenshot shows AWS accounts displayed in Defender for Cloud's [overview d
3230
You can learn more by watching this video from the Defender for Cloud in the Field video series:
3331
- [New AWS connector](episode-one.md)
3432

35-
3633
::: zone pivot="env-settings"
3734

3835
## Availability
@@ -44,9 +41,10 @@ You can learn more by watching this video from the Defender for Cloud in the Fie
4441
|Required roles and permissions:|**Contributor** permission for the relevant Azure subscription. <br> **Administrator** on the AWS account.|
4542
|Clouds:|:::image type="icon" source="./media/icons/yes-icon.png"::: Commercial clouds<br>:::image type="icon" source="./media/icons/no-icon.png"::: National (Azure Government, Azure China 21Vianet)|
4643

47-
4844
## Prerequisites
4945

46+
The native cloud connector requires:
47+
5048
- Access to an AWS account.
5149

5250
- **To enable the Defender for Containers plan**, you'll need:
@@ -105,27 +103,11 @@ You can learn more by watching this video from the Defender for Cloud in the Fie
105103

106104
## Connect your AWS account
107105

108-
Follow the steps below to create your AWS cloud connector.
106+
**To connect your AWS account to Defender for Cloud with a native connector**:
109107

110-
### Remove 'classic' connectors
108+
1. If you have any classic connectors, [remove them](#remove-classic-connectors).
111109

112-
If you have any existing connectors created with the classic cloud connectors experience, remove them first:
113-
114-
1. Sign in to the [Azure portal](https://portal.azure.com).
115-
116-
1. Navigate to **Defender for Cloud** > **Environment settings**.
117-
118-
1. Select the option to switch back to the classic connectors experience.
119-
120-
:::image type="content" source="media/quickstart-onboard-gcp/classic-connectors-experience.png" alt-text="Switching back to the classic cloud connectors experience in Defender for Cloud.":::
121-
122-
1. For each connector, select the three dot button **…** at the end of the row, and select **Delete**.
123-
124-
1. On AWS, delete the role ARN, or the credentials created for the integration.
125-
126-
### Create a new connector
127-
128-
**To create a new connector**:
110+
Using both the classic and native connectors can produce duplicate recommendations.
129111

130112
1. Sign in to the [Azure portal](https://portal.azure.com).
131113

@@ -179,6 +161,22 @@ If you have any existing connectors created with the classic cloud connectors ex
179161

180162
Defender for Cloud will immediately start scanning your AWS resources and you'll see security recommendations within a few hours. For a reference list of all the recommendations Defender for Cloud can provide for AWS resources, see [Security recommendations for AWS resources - a reference guide](recommendations-reference-aws.md).
181163

164+
### Remove 'classic' connectors
165+
166+
If you have any existing connectors created with the classic cloud connectors experience, remove them first:
167+
168+
1. Sign in to the [Azure portal](https://portal.azure.com).
169+
170+
1. Navigate to **Defender for Cloud** > **Environment settings**.
171+
172+
1. Select the option to switch back to the classic connectors experience.
173+
174+
:::image type="content" source="media/quickstart-onboard-gcp/classic-connectors-experience.png" alt-text="Switching back to the classic cloud connectors experience in Defender for Cloud.":::
175+
176+
1. For each connector, select the three dot button **…** at the end of the row, and select **Delete**.
177+
178+
1. On AWS, delete the role ARN, or the credentials created for the integration.
179+
182180
::: zone-end
183181

184182

@@ -353,44 +351,44 @@ The following IAM permissions are needed to discover AWS resources:
353351

354352
| DataCollector | AWS Permissions |
355353
|--|--|
356-
| API Gateway | apigateway:GET |
357-
| Application Auto Scaling | application-autoscaling:Describe* |
358-
| Auto scaling | autoscaling-plans:Describe* <br> autoscaling:Describe* |
359-
| Certificate manager | acm-pca:Describe* <br> acm-pca:List* <br> acm:Describe* <br>acm:List* |
360-
| CloudFormation | cloudformation:Describe* <br> cloudformation:List* |
361-
| CloudFront | cloudfront:DescribeFunction <br> cloudfront:GetDistribution <br> cloudfront:GetDistributionConfig <br>cloudfront:List* |
362-
| CloudTrail | cloudtrail:Describe* <br> cloudtrail:GetEventSelectors <br> cloudtrail:List* <br> cloudtrail:LookupEvents |
363-
| CloudWatch | cloudwatch:Describe* <br> cloudwatch:List* |
364-
| CloudWatch logs | logs:DescribeLogGroups <br> logs:DescribeMetricFilters |
365-
| CodeBuild | codebuild:DescribeCodeCoverages <br> codebuild:DescribeTestCases <br> codebuild:List* |
366-
| Config Service | config:Describe* <br> config:List* |
367-
| DMS – database migration service | dms:Describe* <br> dms:List* |
368-
| DAX | dax:Describe* |
369-
| DynamoDB | dynamodb:Describe* <br> dynamodb:List* |
370-
| Ec2 | ec2:Describe* <br> ec2:GetEbsEncryptionByDefault |
371-
| ECR | ecr:Describe* <br> ecr:List* |
372-
| ECS | ecs:Describe* <br> ecs:List* |
373-
| EFS | elasticfilesystem:Describe* |
374-
| EKS | eks:Describe* <br> eks:List* |
375-
| Elastic Beanstalk | elasticbeanstalk:Describe* <br> elasticbeanstalk:List* |
376-
| ELB – elastic load balancing (v1/2) | elasticloadbalancing:Describe* |
377-
| Elastic search | es:Describe* <br> es:List* |
378-
| EMR – elastic map reduce | elasticmapreduce:Describe* <br> elasticmapreduce:GetBlockPublicAccessConfiguration <br> elasticmapreduce:List* <br> elasticmapreduce:View* |
379-
| GuardDute | guardduty:DescribeOrganizationConfiguration <br> guardduty:DescribePublishingDestination <br> guardduty:List* |
380-
| IAM | iam:Generate* <br> iam:Get* <br> iam:List*<br> iam:Simulate* |
381-
| KMS | kms:Describe* <br> kms:List* |
382-
| LAMDBA | lambda:GetPolicy <br> lambda:List* |
383-
| Network firewall | network-firewall:DescribeFirewall <br> network-firewall:DescribeFirewallPolicy <br> network-firewall:DescribeLoggingConfiguration <br> network-firewall:DescribeResourcePolicy <br> network-firewall:DescribeRuleGroup <br> network-firewall:DescribeRuleGroupMetadata <br> network-firewall:ListFirewallPolicies <br> network-firewall:ListFirewalls <br> network-firewall:ListRuleGroups <br> network-firewall:ListTagsForResource |
384-
| RDS | rds:Describe* <br> rds:List* |
385-
| RedShift | redshift:Describe* |
386-
| S3 and S3Control | s3:DescribeJob <br> s3:GetEncryptionConfiguration <br> s3:GetBucketPublicAccessBlock <br> s3:GetBucketTagging <br> s3:GetBucketLogging <br> s3:GetBucketAcl <br> s3:GetBucketLocation <br> s3:GetBucketPolicy <br> s3:GetReplicationConfiguration <br> s3:GetAccountPublicAccessBlock <br> s3:GetObjectAcl <br> s3:GetObjectTagging <br> s3:List* |
387-
| SageMaker | sagemaker:Describe* <br> sagemaker:GetSearchSuggestions <br> sagemaker:List* <br> sagemaker:Search |
388-
| Secret manager | secretsmanager:Describe* <br> secretsmanager:List* |
389-
| Simple notification service – SNS | sns:Check* <br> sns:List* |
390-
| SSM | ssm:Describe* <br> ssm:List* |
391-
| SQS | sqs:List* <br> sqs:Receive* |
392-
| STS | sts:GetCallerIdentity |
393-
| WAF | waf-regional:Get* <br> waf-regional:List* <br> waf:List* <br> wafv2:CheckCapacity <br> wafv2:Describe* <br> wafv2:List* |
354+
| API Gateway | `apigateway:GET` |
355+
| Application Auto Scaling | `application-autoscaling:Describe*` |
356+
| Auto scaling | `autoscaling-plans:Describe*` <br> `autoscaling:Describe*` |
357+
| Certificate manager | `acm-pca:Describe*` <br> `acm-pca:List*` <br> `acm:Describe* <br>acm:List*` |
358+
| CloudFormation | `cloudformation:Describe*` <br> `cloudformation:List*` |
359+
| CloudFront | `cloudfront:DescribeFunction` <br> `cloudfront:GetDistribution` <br> `cloudfront:GetDistributionConfig` <br> `cloudfront:List*` |
360+
| CloudTrail | `cloudtrail:Describe*` <br> `cloudtrail:GetEventSelectors` <br> `cloudtrail:List*` <br> `cloudtrail:LookupEvents` |
361+
| CloudWatch | `cloudwatch:Describe*` <br> `cloudwatch:List*` |
362+
| CloudWatch logs | `logs:DescribeLogGroups` <br> `logs:DescribeMetricFilters` |
363+
| CodeBuild | `codebuild:DescribeCodeCoverages` <br> `codebuild:DescribeTestCases` <br> `codebuild:List*` |
364+
| Config Service | `config:Describe*` <br> `config:List*` |
365+
| DMS – database migration service | `dms:Describe*` <br> `dms:List*` |
366+
| DAX | `dax:Describe*` |
367+
| DynamoDB | `dynamodb:Describe*` <br> `dynamodb:List*` |
368+
| Ec2 | `ec2:Describe*` <br> `ec2:GetEbsEncryptionByDefault` |
369+
| ECR | `ecr:Describe*` <br> `ecr:List*` |
370+
| ECS | `ecs:Describe*` <br> `ecs:List*` |
371+
| EFS | `elasticfilesystem:Describe*` |
372+
| EKS | `eks:Describe*` <br> `eks:List*` |
373+
| Elastic Beanstalk | `elasticbeanstalk:Describe*` <br> `elasticbeanstalk:List*` |
374+
| ELB – elastic load balancing (v1/2) | `elasticloadbalancing:Describe*` |
375+
| Elastic search | `es:Describe*` <br> `es:List*` |
376+
| EMR – elastic map reduce | `elasticmapreduce:Describe*` <br> `elasticmapreduce:GetBlockPublicAccessConfiguration` <br> `elasticmapreduce:List*` <br> `elasticmapreduce:View*` |
377+
| GuardDute | `guardduty:DescribeOrganizationConfiguration` <br> `guardduty:DescribePublishingDestination` <br> `guardduty:List*` |
378+
| IAM | `iam:Generate*` <br> `iam:Get*` <br> `iam:List*` <br> `iam:Simulate*` |
379+
| KMS | `kms:Describe*` <br> `kms:List*` |
380+
| LAMDBA | `lambda:GetPolicy` <br> `lambda:List*` |
381+
| Network firewall | `network-firewall:DescribeFirewall` <br> `network-firewall:DescribeFirewallPolicy` <br> `network-firewall:DescribeLoggingConfiguration` <br> `network-firewall:DescribeResourcePolicy` <br> `network-firewall:DescribeRuleGroup` <br> `network-firewall:DescribeRuleGroupMetadata` <br> `network-firewall:ListFirewallPolicies` <br> `network-firewall:ListFirewalls` <br> `network-firewall:ListRuleGroups` <br> `network-firewall:ListTagsForResource` |
382+
| RDS | `rds:Describe*` <br> `rds:List*` |
383+
| RedShift | `redshift:Describe*` |
384+
| S3 and S3Control | `s3:DescribeJob` <br> `s3:GetEncryptionConfiguration` <br> `s3:GetBucketPublicAccessBlock` <br> `s3:GetBucketTagging` <br> `s3:GetBucketLogging` <br> `s3:GetBucketAcl` <br> `s3:GetBucketLocation` <br> `s3:GetBucketPolicy` <br> `s3:GetReplicationConfiguration` <br> `s3:GetAccountPublicAccessBlock` <br> `s3:GetObjectAcl` <br> `s3:GetObjectTagging` <br> `s3:List*` |
385+
| SageMaker | `sagemaker:Describe*` <br> `sagemaker:GetSearchSuggestions` <br> `sagemaker:List*` <br> `sagemaker:Search` |
386+
| Secret manager | `secretsmanager:Describe*` <br> `secretsmanager:List*` |
387+
| Simple notification service – SNS | `sns:Check*` <br> `sns:List*` |
388+
| SSM | `ssm:Describe*` <br> `ssm:List*` |
389+
| SQS | `sqs:List*` <br> `sqs:Receive*` |
390+
| STS | `sts:GetCallerIdentity` |
391+
| WAF | `waf-regional:Get*` <br> `waf-regional:List*` <br> `waf:List*` <br> `wafv2:CheckCapacity` <br> `wafv2:Describe*` <br> `wafv2:List*` |
394392

395393
## Learn more
396394

0 commit comments

Comments
 (0)