AWS Role-Based Authentication

Overview

Creating an Identity Access Management Role in AWS

The first step in the connection is to create a configured Identity Access Management (IAM) role. To set up this role, log into your organization's AWS site, and complete the following steps:

1. Open the IAM Console.
2. Click Create Role.

3. Under "Type of Trusted Entity," select the Another AWS account box.

4. In Account ID, enter the following ZenGRC AWS ID: 197323206373. This grants ZenGRC read-only access to your AWS data.

5. Select Require external ID.
   
   
   
   
6. Selecting Require external ID generates another text box called External ID, which requires information from your ZenGRC instance.

7. Copy the AWS External ID in your ZenGRC instance and paste it into the External ID text box in AWS.
   
   

   TIP

   The AWS External ID in your ZenGRC instance refreshes with a time out or when you navigate away from the page. Be aware that a new ID would require you to redo all steps in order to put the new ID in the External ID text box, as shown below.

8. Click Next: Permissions.
   
   
   
   

9. Click Create Policy. This opens a new window. Steps and code needed for the policy can be found in the next documentation sections.
   
   

Creating a Policy

Policy creation is a continuation of the steps documented above for adding an IAM role. You'll need to copy the code on the Code for Your Amazon Web Services Policy page and use it to populate the policy.

To create a policy, compete the following steps:

1. Select the JSON tab.

2. Paste the code from Code for Your Amazon Web Services Policy.

3. Click Review Policy.

4. Name the policy with an apt description, such as "ZenGRCAWSIntegrationPolicy."
   
   
   
   

5. Click Create Policy. A successful submission refreshes the Policy page with a message at page top.
   
   
   
   

6. Close this window to again display the “Create role” page.

7. Refresh the list of policies and select the check box beside the policy you just created.
   
   
   
   

   TIP

   Use the search functionality to reduce the number of policies that display.

8. Click Next: Tags.
   
   
   
   

9. The Tags page is an optional step that you can bypass by clicking Next: Review.

10. Create a role called "ZenGRCAWSIntegrationReadRole" with an optional description. The role must be named "ZenGRCAWSIntegrationReadRole" (without quotes) in order for the connection to work.

11. Click Create Role.