AWP for AWS Environments

When you enable AWP, it creates a cross-account stack on your AWS Amazon® Web Services. Public cloud platform that offers global compute, storage, database, application and other cloud services. account. The cross-account stack deploys in your account these primary resources:

• Cross-account IAM Identity and Access Management (IAM) - A web service that customers can use to manage users and user permissions within their organizations. role

• Proxy utility Lambda

• Multi-Region key (for SaaS mode)

The data that the AWP scanner sends to CloudGuard are only CVEs and paths of the secrets.

All resources that AWP creates in your account have the Owner : CG.AWP tag.

Onboarding AWS Environments

To enable AWP on your AWS environment:

1. In the CloudGuard portal, navigate to Assets > Environments.

2. Click Enable AWP for your AWS environment.

3. Follow the instructions on the wizard page that opens.

   1. Select the scan mode: SaaS or In-Account. For more details, see AWS SaaS Mode.

   2. Click Create a Cross-Account Stack. The prompt suggests you sign in to your AWS account, and then it redirects you to the CloudFormation page. You can see a CFT stack that grants CloudGuard a cross-account role and installs special resources in your AWS account. For more details about the permissions, see Resources and Permissions for SaaS Mode or Resources and Permissions for In-Account Mode.

   3. In AWS, select the option I acknowledge that AWSCloudFormation might create IAM resources with custom names.

   4. Click Create stack. CloudFormation starts to create the stack. After you create the stack, additional permissions are granted to CloudGuard.

   Important - Make sure you do not change the mode (SaaS/In-Account) during the onboarding. For successful onboarding, you must use the same mode that you selected before the stack creation.

4. In the CloudGuard wizard, click Next. CloudGuard completes the process to enable AWP scanning.

AWS SaaS Mode

In the SaaS mode, AWP creates the snapshots of your EC2 Amazon EC2 - A web service for launching and managing Linux/UNIX and Windows Server instances in Amazon data centers. volumes and scans the snapshots on a virtual machine located on the CloudGuard's own AWS account. With this mode, you do not pay for the scans, and CloudGuard fully manages all the required resources.

Scanning Encrypted Volumes in SaaS Mode

For security reasons, AWP does not have access to encrypted volumes in your EC2 instance and cannot scan them. It happens because CloudGuard does not require access to the encryption keys and never obtains them from you as this would compromise your data.

To scan the encrypted volumes securely, CloudGuard re-encrypts the volume data with its own multi-Region key. It installs the key as part of the AWP cross-account stack. Likewise, it installs a proxy utility Lambda function as part of the cross-account stack. With its cross-account role, this Lambda function manages all procedures of the snapshots' creation and re-encryption on remote requests (invocations) from the AWP backend.

This limits access to your account keys only to the proxy Lambda, where you have full visibility and control.

AWS In-Account Mode

With the In-Account mode, AWP scans data locally, so everything stays in your AWS account. The only data sent to CloudGuard are the AWP scanner findings. With this mode, you can keep all your data private, however, the volumes scanning entails additional costs.

Scanning Workflow

To prepare your instance for AWP scanning:

1. With the Cross-account role, AWP gathers information about your instance volumes.

2. With the Cross-account role, AWP remotely invokes the proxy utility Lambda with a request to create snapshots from the instance volumes.

   For Encrypted Snapshots

   In the case of encrypted snapshots, AWP sends one more request to Lambda to re-encrypt the snapshots with the CloudGuard multi-Region key.

   Note - The key resources are regional. Sometimes the instance is in a region where the multi-Region key does not have a replica yet. In such a case, AWP creates a replica of the key in the relevant region, with its Cross-account role.

3. When all instance volumes have their equivalent snapshots created

   • For SaaS mode - a scanner machine launches at the AWP engine with the snapshots attached to it and performs the scanning.

   • For In-Account mode - AWP launches an EC2 instance on the customer account and performs the scanning. This instance runs in the same region as the original EC2, in a custom VPC that AWP creates for this task.

     • The scanner outbound traffic is restricted by a security group rule that limits access exclusively to S3 IP addresses.

     • No inbound rules are configured.

     To ensure that network traffic remains within the AWS backbone, the VPC utilizes an S3 endpoint.

     Note - Make sure that your account does not reach the VPC quota (by default, 5 VPCs for each region) before you enable AWP.

   For Encrypted Snapshots

   The AWP scanner has access to the snapshots' data because they are encrypted with AWP's own multi-Region key.

4. When the scan is complete, AWP sends a request to Lambda to delete the snapshots created for the scan.

Resources and Permissions for SaaS Mode

To enable AWP scanning on the snapshots of your EC2 instances, you have to let the stack install several resources and grant certain permissions to CloudGuard to access assets in your accounts. These permissions are additional to those granted to CloudGuard in the account onboarding process. See below for the details of these resources and required permissions.

Resources and Permissions for In-Account Mode

To enable AWP scanning on the snapshots of your EC2 instances, you have to let the stack install several resources and grant certain permissions to CloudGuard to access assets in your accounts. These permissions are additional to those granted to CloudGuard in the account onboarding process. See below for the details of these resources and required permissions.

Actions

More Links

• Agentless Workload Posture

• AWP for Azure Environments