AWS GuardDuty GovCloud Setup for Workbench

This topic helps you connect AWS GuardDuty GovCloud to Workbench.

Scope and Limitations

When choosing to set up this integration, remember the following:

• You cannot set up this integration via CloudFormation templates or terraform; you must use the manual steps as described in this guide.
• The AWS GuardDuty account must be in a GovCloud region (for example, us-gov-east-1).

Prerequisites

1. Make sure you know your Workbench GUID (you will need it when you create the IAM role).

   • If you need help finding this value, see the Reference section.
2. You must have an AWS account with permissions to create and change IAM roles.
3. If you use AWS Organizations, make sure you have your AWS Account ID.
4. If your organization centralizes CloudTrail logs from multiple subsidiaries into a single S3 bucket, make sure you know the AWS Organizational Unit (OU) ID for the subsidiary.

   • This is an optional prerequisite that enables us to filter logs so that only the relevant data is sent to each subsidiary's Workbench instance, preventing data overlap.

Before You Begin

Determine whether or not you are using an AWS GuardDuty Delegated Admin account.

• If so, you can complete the steps in this guide once, and add a single security device within Workbench for the delegated admin account's primary region.
• If not, you must complete the steps in this guide for each account you want monitored, and add separate security devices within Workbench for each account.

Step 1: Create an IAM Policy

1. Log in to the AWS GovCloud console and navigate to the IAM service. Make sure you are in GovCloud; you cannot perform this step in GuardDuty.
2. Go to Policies and select Create Policy.
3. Add the following permissions using the JSON tab:

{
   "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "guardduty:GetFindings",
                "guardduty:ListDetectors",
                "ec2:DescribeRegions",
                "guardduty:ListFindings",
                "guardduty:GetDetector"
            ],
             "Resource": "*"
        }      
    ]
}

1. Review and name the policy. Make a note of the policy name, as you will need to attach it to the IAM role in the next step.

Step 2: Create an IAM Role

Before you begin, make sure you have your Workbench GUID.

1. Still in GovCloud and from within the IAM service, navigate to Roles.
2. Select Create Role.
3. Create a new role, and use the following custom trust policy (make sure to add your Workbench GUID where indicated):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws-us-gov:iam::071857701673:user/ExpelCloudService"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<YOUR_WORKBENCH_GUID>"
                }
            }
        }
    ]
}

1. Attach the IAM policy you created in Step 1 to the role.
2. Copy and save the Role ARN, as you will need it for the security device in Workbench.

Step 3: Add AWS GuardDuty as a Security Device in Workbench

You will use the AWS GuardDuty device for your GovCloud integration.

Before you begin, make sure you have your IAM Role ARN and Role Session Name. If you use AWS Organizations, you will also need your AWS Account ID as well as the subsidiary's AWS Organizational Unit (OU) ID (the OU ID is only necessary if you use a single S3 bucket for multiple subsidiaries). If you need additional help finding any of these values, see the Reference for detailed instructions.

1. Log in to Workbench.
2. In the side menu, navigate to Organization Settings > Security Devices. If you have multiple organizations, you must select the appropriate organization name from the list.
3. Select Add Security Device.
4. In the search box, enter “GuardDuty” and then select the AWS GuardDuty integration.
5. Select the Connect manually option.
6. You will then see the following fields, which you should complete as follows:

   • Name - enter the host name of the AWS GuardDuty device.
   • Location - enter the geographic location of the appliance.
   • Role ARN - enter the Role ARN from Step 2.
   • Role session name - enter a unique name to identify the role.
   • AWS Region - enter the GovCloud region of the AWS GuardDuty account (for example, us-gov-east-1).
   • AWS OU ID - leave this field blank unless it applies to you.
   • AWS OU Role ARN - leave this field blank unless it applies to you.
7. Select Save.
8. You should now contact Support so that we can manually enable event ingestion.

Important: If you are not using an AWS GuardDuty Delegated Admin account, you must now repeat all of the steps in this guide (beginning at Step 1) for each account you want monitored.

Reference

Workbench GUID

The Workbench GUID is a unique alphanumeric value assigned by Expel to your organization. To find it:

1. Log in to Workbench.
2. Go to Organization Settings > My Organization.
3. On the organization's page, look for the Organization GUID and select the Copy button to copy the GUID.

If you have multiple organizations, you must first select the organization name that will be associated with your integration to access the page with the Copy button. Or, you can stay on the page and highlight then copy the GUID shown for that organization in the GUID column.