AWS API
Connect your AWS account to streamline alert triage and threat analysis.
In this guide, you will learn how to connect Radiant to your AWS account using the AWS API connector. While Radiant already leverages AWS CloudTrail for logging and event history, CloudTrail has inherent limitations when it comes to answering real-time, resource-level questions during alert triage.
For example, CloudTrail does not provide the current state of a resource's configuration—such as the active permissions on an S3 bucket or the current association of an ACL rule to a group, which may have been set years before any recent activity. The AWS API connector fills this gap by enabling Radiant to make direct HTTP queries to the AWS API, retrieving up-to-date access policies, user privileges, and resource configurations at investigation time - resulting in faster and more accurate threat analysis.
Note: Enabling this connector requires creating an IAM role in your AWS environment. If your organization requires a change request approval process before modifying AWS configurations, we recommend initiating that process before proceeding with the steps below.
Add the credentials in Radiant Security
Log in to Radiant Security.
From the navigation menu, select Settings > Credentials and click + Add Credential.
Select Amazon Web Services API from the list and click Configure Credential.
Under Credential Name, give the credential an identifiable name (e.g.
AWS API Credentials).Under AWS Accounts, you have two options for adding your accounts:
If you are using AWS Organizations, you can export a
.csvfile containing all your AWS Account IDs by following these instructions. Once the file is generated, drag and drop it into the upload box.If you prefer to add accounts individually, select + Add Manually to enter each account ID one at a time.
Click Add Credential to save the changes.
Add the AWS API data connector in Radiant Security
From the navigation menu, select Settings > Data Connectors and click + Add Connector.
Search for and select the Amazon Web Services API option and then click Data Feeds.
Under Select your data feeds, select AWS HTTP API and click Credentials.
From the drop-down menu, select the Amazon Web Services API credential that you created in the previous section.
Click Add Connector to save the changes.
In the Data Connectors page, find the AWS API connector and click View Details.
Copy the AWS External Role ID. You'll use this value for the creation of the IAM role in the upcoming steps.
Note: There are two ways to create an IAM Role on your AWS account. If you are using AWS Organizations, we recommend following the StackSets instructions below.
Option 1: Configure the IAM Role manually
Sign in to the AWS Management Console on the main account.
Navigate to IAM.
Click Policies > Create Policy.
Under Specify Permission, select the JSON format and paste the JSON below:
Enter a policy name, review the settings, and select Create policy.
Navigate to the Roles page and select Create role.
On the Select trusted entity page, configure the following:
For Trusted entity type, select Custom trust policy to allow Radiant to assume this role and access the account.
For Custom trust policy, paste the following JSON into the text box:
Note: Replace {RS_CREDENTIAL_ID} with the AWS External Role ID generated during the Radiant credential setup.
On the Add permissions page, find and select the policy you created for this role.
Set the role name as
radiant-aws-api-access-role, review the settings, and select Create role.
Option 2: Configure the IAM Role via StackSets
AWS CloudFormation StackSets enables organizations to deploy infrastructure consistently across multiple AWS accounts and regions.
In your main AWS Organization account, navigate to CloudFormation and select StackSets.
Select Create StackSet.
Download the CloudFormation template file:
rs_iam_role.ymlbelow:
Open the file and replace
{RS_CREDENTIAL_ID}with the AWS External Role ID generated during the Radiant credential setup.In the Permissions section, select Service-managed permissions.
In the Prerequisite - Prepare template section, select Template is ready.
In the Specify template section, select Upload a template file and upload the CloudFormation template file you downloaded and edited in step 4.
Specify the StackSet name and parameters and click Next.
In the Capabilities section, acknowledge that IAM resources will be created.
In the Deployment targets section, select one of the following options:
To deploy the StackSet across your entire organization, select Deploy to organization.
To deploy the StackSet to specific accounts only, select Deploy to organizational units (OUs). Enter the AWS OU IDs for the target accounts, then, under Account filter type - optional, select the Intersection filter and add the account numbers you want to deploy the StackSet to.
In the Specify regions section, add all the regions where the StackSet should be deployed.
Review your configuration and select Submit to deploy the StackSet.
Last updated
Was this helpful?