Creating a policy and adding an AWS Hypersync user
Note
Hyperproof connects to many third-party systems that frequently change, including the system interface. Contact your System Administrator or the third-party provider for assistance meeting the requirements to integrate with Hyperproof and collect the proof you need.
Tip
If you prefer, you can also provision and use a group or a role rather than an individual user.
Introduction
AWS Hypersyncs use a variety of AWS Actions to collect proof. The information in the table below allows AWS administrators to create a policy that matches the Hypersyncs used by their compliance team. An AWS administrator can either start from the policy in step 5 of the Creating a policy section below and remove permissions for Hypersyncs they won’t use, or they can construct a new policy file from scratch using the information in the table.
Use Case | Action(s) | Notes |
---|---|---|
Creating a connection using Access Key ID/Secret Access Key |
| Used to identify the connection. |
Creating Hypersyncs for Amazon services that specify a region: Backup, EC2, EKS, Security Hub, VPC |
| Used to give a list of regions to select from while creating or editing a Hypersync. |
Creating a connection using a cross-account role and multiple accounts |
| Used to enumerate accounts, search by account number, and find accounts using tags. |
AWS Backup Hypersyncs |
| Used to collect proof data. |
EC2/VPC Hypersyncs |
| Used to collect proof data. |
Security Hub Hypersyncs |
| Used to collect proof data. |
EKS Hypersyncs |
| Used to collect proof data. |
IAM Hypersyncs |
| Used to collect proof data. |
Identity Center Hypersyncs |
| Used to collect proof data. |
RDS Hypersyncs |
| Used to collect proof data. |
S3 Hypersyncs |
| Used to collect proof data. |
Creating a policy
In the AWS Management Console, expand View all services.
Below Security, Identity, & Compliance, click IAM.
The IAM dashboard opens.
From the left navigation window, expand Access management, and then click Policies.
Click Create policy.
Select the JSON tab, and then paste the file below.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "ActionsForHyperproofHypersyncs", "Action": [ "backup:GetBackupPlan", "backup:ListBackupJobs", "backup:ListBackupPlans", "backup:ListBackupSelections", "ec2:DescribeClientVpnEndpoints", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeNetworkAcls", "ec2:DescribeRegions", "ec2:DescribeSecurityGroups", "ec2:DescribeSnapshots", "ec2:DescribeSubnets", "ec2:DescribeVolumes", "ec2:DescribeVolumeStatus", "ec2:DescribeVpcs", "eks:DescribeCluster", "eks:ListClusters", "iam:GetAccountAuthorizationDetails", "iam:GetAccountPasswordPolicy", "iam:GetGroup", "iam:GetUser", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListRoles", "iam:ListSAMLProviders", "iam:ListUsers", "iam:ListVirtualMFADevices", "identitystore:ListUsers", "organizations:DescribeAccount", "organizations:ListAccounts", "rds:DescribeDBClusters", "rds:DescribeDBInstances", "resource-groups:SearchResources", "s3:GetBucketPolicyStatus", "s3:GetBucketVersioning", "s3:GetBucketObjectLockConfiguration", "s3:GetBucketAcl", "s3:GetEncryptionConfiguration", "s3:GetReplicationConfiguration", "s3:GetLifecycleConfiguration", "s3:ListAllMyBuckets", "s3:ListBucket", "securityhub:DescribeProducts", "securityhub:DescribeStandards", "securityhub:GetFindings", "securityhub:GetInsights", "securityhub:ListEnabledProductsForImport", "ssm:GetInventory", "sso:ListInstances", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" } ] }
Click Next.
Enter a name for the policy and, optionally, a description.
Optionally, add tags for the policy.
Click Create Policy.
Creating a new user
From the left navigation menu, expand Access management, and then click Users.
Click Add users.
In the User name field, enter a unique username, and then click Next.
Select the Attach policies directly radio button.
In the search bar, enter the name of the policy created in the previous section.
Select the checkbox next to the policy name.
Click Next.
Optionally, add tags for the user.
Review your choices, and then click Create user.