AWS Policies
AWS policies set what a scan collects and checks in AWS environments.
Edit Scan Policy (AWS)
On the General tab you enable or disable the scan modules, set the options and define exclusions. The Edit Scan Policy page has four tabs: General, Vulnerability, Tier 0 Assets and Compliance (see Compliance Frameworks).
Vulnerability Policies and Tiering (AWS)
The Vulnerability tab sets which AWS checks run during the scan (see Vulnerability Policies). The Tier 0 Assets tab marks your most critical identities.
AWS Scan Modules
AWS Assessment: Checks vulnerabilities, misconfigurations and access relationships in AWS IAM, including users, groups, roles, policies and access keys. It is the core module and cannot be disabled.
Identity Center Assessment: Collects IAM Identity Center data: the instance, permission sets, SSO users and groups, and the account assignments that map them to roles in member accounts. It also adds the Identity Center relationships to the graph, such as which SSO user can assume which role. The module is enabled by default in every AWS policy, including policies created before it existed. When it is disabled, the scan skips Identity Center and collects IAM identities only. Reading Identity Center requires the management account or the account registered as the Identity Center delegated administrator. The Organization delegation row on the AWS Configuration page shows whether that registration is in place.
Tier0 Analysis: Optional. Calculates the attack paths and privilege escalation routes through which identities can reach Tier 0 assets.
General Settings
Name
The name of the scan policy.
Include Inactive Accounts
Includes inactive accounts in the scan. Enabled by default.
Include Disabled Accounts
Includes disabled accounts in the scan. Enabled by default.
Inactivity Threshold
The number of days without use after which an access key or console password counts as unused. The default value is 45.
Exclusions
Entities to exclude from the scan. The types are Account, User, Group, Role and Policy (see General Exclusions).
Tier 0 Assets (AWS)
On the Tier 0 Assets tab you mark critical AWS IAM entities as privileged. The types are AWSIAMUser, AWSIAMGroup, AWSIAMRole and AWSIAMPolicy. Tier 0 assets are treated as high-impact entities in the attack path analysis.
Last updated
Was this helpful?