AWS

Amazon Web Services (opens in a new tab) (AWS) is Amazon's cloud computing platform. The AWS monitor discovers the services and storage systems in your AWS account — across every region enabled for the account — and surfaces them in the Action Center for review.

How the AWS monitor works

The monitor authenticates to your AWS account with the credentials you provide and uses AWS Resource Explorer (opens in a new tab) to search for resources. The monitor discovers your account's enabled regions and scans all of them automatically. For each resource it captures the name, cloud service, resource type, ARN, account ID, region, and tags.

Discovered resources appear in the Action Center, where you assign them to systems and approve them into your system inventory. See the Cloud Providers overview for the review workflow.

Prerequisites

In order to integrate with AWS, you'll need to decide how Fides authenticates and gather credentials if you're using an access key pair:

• Authentication Method: secret_keys to authenticate with an IAM access key pair, or automatic to use the AWS credential provider chain. Use automatic when Fides runs in your own AWS account with an attached IAM role.
• Access Key ID: part of the IAM access key pair. Required when using secret_keys authentication.
• Secret Access Key: the secret half of the IAM access key pair. Required when using secret_keys authentication.
• Assume Role ARN (optional): the ARN of a role Fides should assume after authenticating, typically for cross-account access. Works with either authentication method.
• Permissions: the authenticated identity must be allowed to call resource-explorer-2:Search, ec2:DescribeRegions, and sts:GetCallerIdentity, and AWS Resource Explorer must be enabled in your account.

Set up an AWS monitor

To integrate with AWS:

1. Navigate to Integrations.
2. Click Add integration.
3. Select Amazon Web Services.
4. Choose an Authentication Method — secret_keys or automatic.
5. For secret_keys authentication, provide the Access Key ID and Secret Access Key. Optionally provide an Assume Role ARN, then click Save.
6. Add a monitor and set the execution schedule, or leave it unset to run manually.

You may confirm your connection is working using the Test connection button — Fides validates the credentials by calling AWS STS (opens in a new tab) to verify the authenticated identity.

To learn more, please see our guide for Managing integrations.

For details on reviewing discovered resources, assigning them to systems, and approving them into your system inventory, see the Cloud Providers overview.