Based on the capabilities selected, CloudFormation Template (CFT) is generated. Use the generated CFT template in your AWS CloudFormation to create the policy for the User or Role.

To enable segmentation, you must also enable Gather Labels.

This template has the IAM privileges required for the capabilities that you selected in the previous step.

If you enabled the Kubernetes option, you must separately configure permissions for EKS. See Managed Kubernetes Services Running on AWS (EKS).

We recommend this task whether or not you are using AWS cross-account access.

You can apply the CFT using either the portal or the CLI. For more information, see:

• Portal: AWS Management Console

• CLI: Creating a stack

When you upload the CFT, AWS requires the following details:

1. Name of the policy (This can be anything. For example, Secure WorkloadConnector)

2. Rolename: Name of the AWS IAM role to which you are applying the CFT

3. List of bucket ARNs And Object ARNs (Default: *)

4. Username: Name of the AWS user to which you are applying the CFT

5. List of VPC ARNs (Default: *)

   To enter a specific list of VPC ARNs, enter the security group and network interface resources paired with the specific VPC to enable segmentation.

   1. arn:aws:ec2:<region>:<account_id>:security-group/*

   2. arn:aws:ec2:<region>:<account_id>:network-interface/*

   Sample Code

   Example 1

   {
   			"Action": [
   				"ec2:RevokeSecurityGroupIngress",
   				"ec2:AuthorizeSecurityGroupEgress",
   				"ec2:AuthorizeSecurityGroupIngress",
   				"ec2:CreateSecurityGroup",
   				"ec2:RevokeSecurityGroupEgress",
   				"ec2:DeleteSecurityGroup",
   				"ec2:ModifyNetworkInterfaceAttribute",
   				"ec2:CreateTags"
   			],
   			"Resource": [
   				"arn:aws:ec2:us-east-1:123456789:vpc/vpc-abcdef",
   				"arn:aws:ec2:us-east-1:123456789:security-group/*",
   				"arn:aws:ec2:us-east-1:123456789:network-interface/*"	
   			],
   			"Effect": "Allow"
   		},
   
   

   Example 2

   {
   			"Action": [
   				"ec2:RevokeSecurityGroupIngress",
   				"ec2:AuthorizeSecurityGroupEgress",
   				"ec2:AuthorizeSecurityGroupIngress",
   				"ec2:CreateSecurityGroup",
   				"ec2:RevokeSecurityGroupEgress",
   				"ec2:DeleteSecurityGroup",
   				"ec2:ModifyNetworkInterfaceAttribute",
   				"ec2:CreateTags"
   			],
   			"Resource": [
   				"arn:aws:ec2:us-east-1:123456789:vpc/vpc-abcdef",
   				"arn:aws:ec2:*:*:security-group/*",
   				"arn:aws:ec2:*:*:network-interface/*"	
   			],
   			"Effect": "Allow"
   		},
   

1. You can use the same uploaded CFT to give access to role/user. If you have multiple account use the same CFT on each account.

2. Upload the CFT to the AWS CloudFormation portal of each AWS account where the desired IAM role exists.

   You can apply the CFT using either the portal or the CLI, as described in the previous step.

   When you upload the CFT, AWS asks for the following:

   1. Name of the policy (This can be anything. For example, Secure WorkloadConnector)

   2. List of bucket ARNs And Object ARNs (Default: *)

   3. Rolename: Name of the AWS IAM role to which you are applying the CFT

   4. List of VPC ARNs (Default: *)

You can use either of the one option to connect to AWS account.

1. Credential Keys

2. Roles

Generally, you should enable flow ingestion as soon as possible, so that Secure Workload can begin to collect enough data required to suggest accurate policies.

Note that since EKS only supports Gather Labels capability, no explicit capability selection has been provided. Selecting an EKS cluster will implicitly enable the supported capability. For each cluster for which you enable this capability, enter the Assume Role ARN (The Amazon resource number of the role to assume while connecting to Secure Workload.)

Enable Segmentation on VPCs will remove existing Security Group(s) and provides default access to all VPCs.

Generally, you should not choose Enable Segmentation during initial configuration. Later, when you are ready to enforce segmentation policy for specific VPCs, you can edit the connector and enable segmentation for those VPCs. See the Best Practices When Enforcing Segmentation Policy for AWS Inventory.