About

The AWS integration connects ControlMap to your client's Amazon Web Services (AWS) account and collects evidence for compliance automatically. ControlMap runs cloud security checks against the account, so you can see whether things like databases and security groups meet best practice without checking them by hand.

The integration brings in:

• Cloud security check results. The set of checks is called AWS CIS Controls.
• AWS IAM users, which appear as user accounts.
• Cloud resources such as databases, storage, networks and servers, which appear as assets.

ControlMap connects through an IAM role that you create in AWS with a template ControlMap provides. The role has READ and LIST only permissions.

Before you start

Have this ready:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• An AWS account where you can launch a CloudFormation stack. The stack creates the IAM role that ControlMap uses.

Connect AWS

1. Go to Monitor › Integrations and select Add Integration.
2. Search for AWS and select the AWS card, listed under Cloud Infrastructure.

3. On the Connection step, check the Connection Name. ControlMap fills in a default name, which you can change.
4. Select Create ControlMap role in your AWS. A new browser tab opens on AWS CloudFormation with the ControlMap template already loaded.
5. In AWS, create the stack. When it finishes, open the stack's Outputs tab and copy the ARN of the role.
6. Back in ControlMap, paste the ARN into ControlMap Role ARN. This field is required.
7. Select Next: Checks. ControlMap tries to use the role to connect to your AWS account and saves the connection.

A help panel beside the form shows the AWS cloud connector article, including the list of checks. Select Read this article on Support Portal to open it on its own.

Complete the remaining steps as described in the Connect an integration article. They are Checks, Watchers and Schedule.

What you'll see after connecting

After the first scan, the connection's data appears in Monitor:

• Compliance Checks: the AWS CIS Controls results. A check shows No Data until the first scan has finished.
• User Accounts: the AWS IAM users.
• Assets: the cloud resources ControlMap found.

Select the connection's card on the Integrations page to open its page. The header shows the connection name, the Cloud Infrastructure category and the connection status. The Connection tab shows Successfully connected when the connection works.

To scan straight away instead of waiting for the schedule, select Run Once.

Disconnect or change settings

To change the connection, the schedule or who is notified:

1. Go to Monitor › Integrations and select the AWS card.
2. Use the Connection, Schedule or Watchers tab, as described in the Connect an integration article.
3. To use a different role, enter the new ARN in ControlMap Role ARN and select Update Connection. For security, the saved ARN is hidden and the field shows only the last five characters of the current value.

To remove the integration, select the bin icon on its card on the Integrations page, as described in the Connect an integration article. Deleting an integration also deletes its assets and their compliance status.