Create AWS Organization Connector

Provide a name and description for the connector. We recommend you provide a unique name for the connector.

Select applications that are applicable for the connector. 

Select Enable Remediation to enable remediation on the connector. You need to configure additional permissions before you enable remediation for AWS connectors. 

Note: Ensure that the member connector has write access to the AWS account for which you enable remediation.

Select an account type for your organization connector: Global, or US GovCloud. You can choose only one account type per connector.

Select a frequency at which the org connector should poll the cloud provider and fetch data. The designated interval for the org connector determines when it automatically run scans for new or deleted accounts. Choose any period under 24 hours as the interval to auto-run the scan.

By default, the connector polling frequency is configured for every 4 hours. As a result, the connector will connect with the cloud provider every 4 hours to fetch the data.

This lets you grant Qualys access to your AWS resources without sharing your AWS security credentials. Qualys will access your AWS resources by assuming the IAM role that you create in your AWS account. Learn more.

AWS requires that vendors provide a unique external ID value amongst all their customers when providing a vendor account for a trust relationship. However, we no longer require customers to adhere to any fixed format for external ID. Learn more 

In the Role ARN Information,  paste Role ARN, and click Add.

Click Test Connection to verify if the organization connector can successfully authenticate using the provided role ARN information. If the test connection is successful, proceed with the connector creation process. If the test connection fails, you may need to check and update the authentication details.

Note: The next steps are enabled only after the test connection is successful.

Select a frequency at which the member account connector should poll the cloud provider and fetch data. The designated interval for the member connector determine when the connectors will be automatically run. Choose any period under 24 hours as the interval to auto-run the scan.

By default, the connector polling frequency is configured for every 4 hours. As a result, the connector will connect with the cloud provider every 4 hours to fetch the data.

Enter the prefix that will be added to the member account connector. This prefix will show which organization the member account connector is connected to.

This lets you grant Qualys access to your AWS resources without sharing your AWS security credentials. Qualys will access your AWS resources by assuming the IAM role that you create in your AWS account. Learn more.

To adhere to the AWS vendor requirement best practices, we have modified the format of the external ID. AWS requires that vendors provide a unique external ID value amongst all their customers when providing a vendor account for a trust relationship. Learn more 

In the Application list, select the Application (CloudView/AssetView), provide the Role Name, and click Add.

Configure the organization connector. Here, you can select the Organization Units where member connectors are created for the accounts present under it. Select all OUs, select specific OUs or exclude OUs. 

All- Member connectors will be created for all the accounts under all the OUs.

Select OUs- Member connectors will be created for all the accounts under the selected OUs.

Exclude OUs- Member connectors will not be created for the accounts present under the excluded OUs.

The connector details for AWS organization connectors also allow you to:

1) Automatically create member connectors for new accounts by selecting the 'Automatically create connectors for new accounts' checkbox. 

2) Automatically disable member connectors for the accounts you delete by selecting 'Disable connectors for deleted accounts' checkbox. 

The connector will automatically scan for these changes during the polling frequency interval.

Select regions to discover the asset/resource and fetch the data from the member connectors of all the selected regions. 

Note: Region selection is only applicable for AV connectors. CV connectors will continue to show resources for all the regions even if a few regions are selected while creating connectors.

We can activate AWS assets for scanning automatically so you do not have to take this extra step. Select the required check box to enable activation for the required app. We automatically activate the assets as they are discovered and even assign them tags if you want. 

Enabling Cloud Perimeter Scan 

When you select the Automatically activate all assets for VM Scanning application check box, you can see a check box to enable cloud perimeter scan. Show meShow me

Select the Enable Cloud Perimeter Scan if you want to enable launching perimeter scans on all the member AWS connectors associated with the AWS organization connector. The settings you configure for AWS organization connector are applied to all the member connectors for the cloud perimeter scan.

Perimeter scan jobs are run automatically based on the settings defined in the Scan Settings step or in the Cloud Perimeter Scan - Global Scan Configuration.

Select Asset Tags

We recommend you create at least one generic asset tag (for example, EC2) and have the connector automatically apply that tag to all imported assets. You can add more tags to your EC2 assets based upon discovered EC2 metadata.

Assign tags to the connector that you are creating. You can also create a new tag. For details on creating new tags, see Configure Tags in Qualys CyberSecurity Asset Management documentation. 

Review the connector settings you configured and then click Create Connector.