AWS Resource Inventory
Upon setting up the AWS connector, it starts discovering the resources in your AWS account. The inventory and the metadata of the resources are pushed to the Qualys portal. For a list of the resources that are getting collected, refer to Resources List.
To fetch the updated resources, you need to select Run from the quick actions menu for the AWS connector.
AWS Inventory for Cloud Identity Management
The AWS Inventory now includes support for Cloud Identity Entitlement Management. This security and identity management solution helps organizations control access to cloud-based resources and applications, following the principle of least privilege.
How Does Identity Management Help Secure Your Cloud?
CIEM solves the following challenges in your cloud environment.
Complexity
In the cloud, identities extend beyond users or service accounts; machine identities also exist. As Cloud infrastructures grow in complexity, managing identity entitlement guarantees control over the various identities in the infrastructure, reducing the management complexities.
Access Control
Reducing the challenges of maintaining the principle of least privilege. Cloud admins often provide excessive permissions to various personas. Managing the associated privileges can go a long way in securing the cloud network.
Identity Lifecycle Management
Helps automate and keep user and service identity lifecycles up to date, including onboarding, offboarding, and role changes.
Audit and Compliance
Maintain audit trails to ensure compliance with industry regulations and internal policies.
Emerging Threats: Stay ahead of emerging security threats and vulnerabilities.
How Does TotalCloud Assist in Managing Identity Entitlement?
TotalCloud AWS Inventory has introduced additional resources to the inventory specific to CIEM. These resources can help track the permissions associated with the identities in your environment. The Policy Analyzer reviews these resources and checks them against newly introduced insights to show gaps in identity entitlements.
Resources List
will discover and fetch the following resources and their corresponding attributes to display in the inventory. We support only the following resource type.
- RDS
- Network ACL
- S3 Bucket
- IAM User
- VPC
- Security Group
- Lambda Function
- Subnet
- Internet Gateway
- Load Balancer
- Instance
- Route Table
- EBS Volume
- Auto Scaling Group
- EKS Cluster
- EKS Node Group
- EKS Fargate Profile
- VPC Endpoint
- VPC Endpoint Service
- IAM Group
- IAM Policy
- IAM Role
- SageMaker Notebook
- CloudFront Distribution
- Route 53 Domains
- Route 53 Hosted Zone
- Redshift
- Elastic Container Registry
- Elastic Container Service (ECS)
- Elastic Network Interface (ENI)
- Elastic File System (EFS)
- Custom Domain Names
- Step Function (State Machine)
- Simple Notification Service (SNS)
- Simple Queue Service (SQS)
- API Gateway
For IAM resources, the Policy Analyzer does not work on China accounts. TotalCloud only creates an inventory of the Policies. They will not be analyzed with Insights.
You can find additional resources on the inventory beyond what is listed above. These additional resources can be viewed but it does not have a Resource Details page and neither do they have dedicated tokens.
Known Issues
- TotalCloud currently restricts the CSV download feature temporarily for the resource inventory. This limitation is planned to be addressed in the next release.
- TotalCloud currently only fetches API Gateway resources of the REST API type and not HTTP or Web Sockets types. This limitation is planned to be addressed in future releases.