Setup: AWS

Select Amazon Web Services

Go to Cloud Scan > Settings, click New Provider, and select AWS.

Create a new policy

Configure the policy

1. Go to the AWS policy creator and log in with your administrator account.

2. Click the JSON tab and paste the following policy into the editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetRepositoryScanningConfiguration",
        "ecr:DescribeImageScanFindings",
        "ecr:DescribeImages",
        "dynamodb:ListTagsOfResource",
        "ecr:ListTagsForResource",
        "inspector2:BatchGet*",
        "inspector2:Get*",
        "inspector2:Describe*",
        "inspector2:List*",
        "sqs:ListQueueTags",
        "sso:Describe*",
        "sso:List*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": [
        "datapipeline:EvaluateExpression",
        "datapipeline:QueryObjects",
        "rds:DownloadDBLogFilePortion"
      ],
      "Resource": "*"
    }
  ]
}

1. Click Next.

Save the policy

1. Name the policy StoikAdditionalPermissions.

2. Click Create policy.

Create a new role

Configure the role trust

1. Go to the AWS role creator.

2. Click AWS account, then Another AWS account, and enter the following account ID:

436578779424

1. Select Require external ID and copy the value displayed in the Stoïk Protect console.

2. Click Next.

Assign permissions and finalize

1. Select StoikAdditionalPermissions and SecurityAudit as permissions.

2. Click Next.

3. Enter stoik-auditor as the role name.

4. Click Create role.

Add an ARN identifier

1. Go to the stoik-auditor role you just created.

2. Copy the ARN reference.

Complete setup

1. Paste the ARN reference into the dedicated field in the Stoïk Protect console.

2. Click Complete set-up.