Add an AWS account using a manager instance role

Follow the instructions below to add an AWS account to Deep Security Manager using a manager instance role. Use this method if Deep Security Manager is running inside of AWS.

Note

The term 'AWS Primary Account' will be used throughout this topic to describe the AWS account under which your Deep Security Manager is located.

First, log in to the AWS Primary Account

Go to Amazon Web Services at https://aws.amazon.com/.
Sign in using your AWS Primary Account.

Next, configure an IAM policy

In the Amazon Web Services Console, go to the IAM service.
In the left navigation pane, click Policies.
Click Create policy.
Select the JSON tab.

Copy the following JSON code into the text box:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "cloudconnector",
            "Action": [
                "ec2:DescribeImages",
                "ec2:DescribeInstances",
                "ec2:DescribeRegions",
                "ec2:DescribeSubnets",
                "ec2:DescribeTags",
                "ec2:DescribeVpcs",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeSecurityGroups",
                "workspaces:DescribeWorkspaces",
                "workspaces:DescribeWorkspaceDirectories",
                "workspaces:DescribeWorkspaceBundles",
                "workspaces:DescribeTags",
                "iam:ListAccountAliases",
                "iam:GetRole",
                "iam:GetRolePolicy",
                "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

The "sts:AssumeRole" permission is required only if you plan on adding more AWS accounts to the manager (using cross account roles).

The "iam:GetRole" and "iam:GetRolePolicy" permissions are optional, but recommended because they allow Deep Security to determine whether you have the correct policy when an update to the manager occurs that requires additional AWS permissions.

Click Review policy.
Give the policy a name and description. Example name: Deep_Security_Policy.
Click Create policy. Your policy is now ready to use.

Next, create a manager instance role

Go to the IAM service.
Click Roles.
Click Create role.
Make sure the AWS service box is selected.
Click EC2 from the list of services. More options are revealed.
Click EC2 Allows EC2 instances to call AWS services on your behalf. Click Next: Permissions.
Select the check box next to the IAM policy you just created. Click Next: Review.
Enter a Role name and Role description. Example role name: Deep_Security_Manager_Instance_Role
Click Create role.

Next, attach the manager instance role to the manager in AWS

Go to the EC2 service.
Click Instances on the left, and select the check box next to the EC2 instance where your Deep Security Manager is installed.
Click Actions > Instance Settings > Attach/Replace IAM Role.
From the IAM role drop-down list, select the manager instance role (Deep_Security_Manager_Instance_Role).
Click Apply.

You have now created a manager instance role with the correct IAM policy, and attached it to the Deep Security Manager's EC2 instance.

Next, configure the manager instance role in the manager

In Deep Security Manager, click Administration at the top.
Click System Settings on the left.
Click the Advanced tab in the main pane.
Scroll to the bottom and look for the Manager AWS Identity section.

Make sure Use Manager Instance Role is selected.

Note

If Use Manager Instance Role does not appear, make sure that you attached the role to the EC2 instance where Deep Security Manager is installed, and then Restart the Deep Security Manager . On restart, Deep Security detects the role of the manager's EC2 instance and displays the Use Manager Instance Role option.

Click Save.

Finally, add the AWS Primary Account to the manager

In Deep Security Manager, click Computers at the top.
In the main pane, click Add > Add AWS Account.
Select Use Manager Instance Role.
If the AWS Primary Account includes Amazon WorkSpaces, select Include Amazon WorkSpaces to include them with your Amazon EC2 instances. By enabling the check box, you ensure that your Amazon WorkSpaces appear in the correct location in the tree structure in Deep Security Manager and are billed at the correct rate.
Click Next.

Deep Security Manager uses the manager instance role that is attached to its Amazon EC2 instance to add the AWS Primary Account's EC2 and WorkSpace instances to Deep Security Manager.

You have now added the AWS Primary Account to Deep Security Manager. The Amazon EC2 instances and Amazon WorkSpaces under this AWS account are loaded.

After completing the above tasks, proceed to Install the agent on your Amazon EC2 and WorkSpace instances if you have not done so already.