Onboarding the AWS suite and applications

This section outlines instructions for onboarding the AWS suite in CASB. You can choose to perform an automated or manual onboarding depending on your needs.

Automated onboarding

You can onboard the AWS suite automatically using the provided Terraform module.

Onboarding with Terraform

1. In the Management Console, select Administration > System Settings > Downloads.

2. Locate the file aws-onboarding-terraform-module-<version>.zip and download it.

3. Extract the contents of the zip file.

4. Locate and open the file README-Deployment steps.pdf.

5. Follow the instructions provided in the README file to complete the automated onboarding.

Manual onboarding

This section outlines instructions for configuring the AWS suite for manual onboarding in CASB, followed by the manual onboarding instructions.

Configuration steps

Before you onboard the AWS application, you must perform a set of configuration steps.

Note: These configuration steps are only necessary if you plan to onboard AWS in API mode. If you plan to onboard AWS in inline mode, skip to Onboarding steps.

To get started, log in to the AWS console (http://aws.amazon.com).

Then, perform the following configuration steps.

• Step 1 – Create an Identity Access Management (IAM) role for Juniper CASB

• Step 2 – Create a Cloud Trail

• Step 3 – Create Simple Queue Service (SQS)

• Step 4 – Configure Event Notifications for the Cloud Trail Bucket

• Step 5 – Create an IAM Monitor policy

• Step 6 – Create an IAM DLP policy

• Step 7 – Create an IAM Cloud Security Posture Management (CSPM) policy

• Step 8 – Create an IAM Key Management Service (KMS) policy

• Step 9 – Attach the policies to the IAM role

Step 1 – Create an Identity Access Management (IAM) role for Juniper CASB

1. Click Roles and select Create role.

2. Select Role Type: Another AWS Account.

3. For Account ID, obtain this ID from the Juniper Networks team. This is the account ID for the AWS account in which the tenant Management Server is onboarded.

4. Under Options, check Require External ID.

5. Enter the following information:

• External ID – Enter a unique attribute to be used while onboarding AWS S3 in CASB.

• Require MFA – Do not check.

6. Click Next: Permissions. Do not attach any policies at this point.

7. Click Next: Tags and (optional) enter any tags you want to include to the Add Tags page.

8. Click Next: Review.

9. Enter a Role Name (for example, Juniper-AWS-Monitor) and click Create Role.

10. Search for the role name you created and click it.

11. Copy the role ARN.

12. Select Roles > Trust relationships tab > Juniper-AWS-Monitor summary view. Locate the Conditions section and copy the ExternalID value.

Step 2 – Create a Cloud Trail

1. From Services, go to Cloud Trail.

2. Select Trails from the left panel.

3. Click New Trail and enter the following information.

• Trail name – ccawstrail (for example)

• Storage location – Select Create a new S3 bucket to create a new bucket or Use existing S3 bucket to pick up existing buckets in which  to store logs. Enter or select the desired bucket name.

4. Click Next. The Choose log events screen is displayed.

   • Events – Select Management events and (optionally) Data events.

   • Management Events – Select Read and Write.

   • Data Events (optional) – Configure data events if you want to see activity audit logs and AWS monitoring screens.

5. Click Next.

6. Click CreateTrail.

7. Copy the Cloud Trail ARN and S3 Bucket ARN.

Step 3 – Create Simple Queue Service (SQS)

1. Under Services, go to Simple Queue Service (SQS).

2. Click Create New Queue.

3. Enter a Queue Name and select Standard Queue as the queue type.

4. Click Create Queue.

5. Copy the new queue’s ARN.

6. Go to the Access Policy section.

7. Click the Edit button and paste the following policy information.

   {

   "Version": "2008-10-17",

   "Id": " default_policy_ID",
   "Statement": [

   {

   "Sid": "__receiver_statement",
   "Effect": "Deny",
   "Principal": {

   "AWS": "<<Role_ARN>>"

   },

   "Action": [
   "sqs:ReceiveMessage",
   "sqs:ChangeMessageVisibility",
   "sqs:DeleteMessage"
   ],
   "Resource": "<<Queue_ARN>>"

   "Condition": {
     "ArnNotEquals": {
       "aws:PrincipalArn": "<<Role_ARN>>"

       }

     }
   },

   {

   "Sid": "__sender_statement",
   "Effect": "Allow",
   "Principal": {
   "Service": "s3.amazonaws.com"
   },
   "Action": "sqs:SendMessage",
   "Resource": "<<Queue_ARN>>",
   "Condition": {

     "ArnEquals": {

       "aws:SourceArn": "<<S3_Bucket_ARN>>"
       }
     }
   }

   ]

   }

In the above code, make sure to replace all of the strings in double brackets ( << >> ) with the appropriate values:

8. Replace <<Role_ARN>> with the role ARN that you copied at the end of Step 1 – Create an IAM role for Juniper CASB.

9. Replace <<Queue_ARN>> with the queue ARN that you copied in step 5 of this section.

10. Replace <<S3_Bucket_ARN>> with the bucket ARN that you copied at the end of Step 2 – Create a Cloud Trail.

11. Click Create Queue.

Step 4 – Configure Event Notifications for the Cloud Trail Bucket

1. Under Buckets, go to the bucket that stores the CloudTrail logs (for example, awstrailevnts). 

2. Click the Properties tab for the bucket. 

3. Go to the Event Notifications section and click Create event notification. 

4. Enter the following information for the notification. 

• Name – any naming (for example, SQS Notification)

• Event Types – Select All object create events.

• Filters  - Enter any filters to apply to the notification.

• Destination – Select SQS Queue. 

• Specify SQS Queue – Select the SQS queue that you created in Step 3 – Create Simple Queue Service.
  
  Note: Make sure that your S3 Bucket and SQS queue are in the same region.

5. Click Save Changes. 

   The event is created.

Step 5 – Create an IAM Monitor policy

1. Click Services and select IAM.

2. Select Policies and click Create Policy.

3. Click the JSON tab.

   

4. Copy and paste the following policy information.

   {

     "Statement": [

       {

         "Action": [

           "cloudtrail:DescribeTrails",

           "cloudtrail:LookupEvents",

           "iam:Get*",

           "iam:List*",

           "s3:AbortMultipartUpload",

           "s3:DeleteObject",

           "s3:GetBucketAcl",

           "s3:GetBucketLocation",

           "s3:GetBucketNotification",

           "s3:GetObject",

           "s3:ListAllMyBuckets",

           "s3:ListBucket",

           "s3:ListMultipartUploadParts",

           "s3:PutBucketAcl",

           "s3:PutBucketNotification",

           "s3:PutObject",

           "s3:ListBucketMultipartUploads"

         ],

         "Effect": "Allow",

         "Resource": "*",

         "Sid": "CasbAwsMonitorPolicy"

       }

     ],

     "Version": "2012-10-17"

   }

5. Click Review Policy at the lower right portion of the screen.

6. Give the policy the name iam-monitor-policy and click Create Policy.

Step 6 – Create an IAM DLP policy

1. Click Services and select IAM.

2. Select Policies and click Create Policy.

3. Click the JSON tab.

   

4. Copy and paste the following policy information.

{

    "Statement": [

        {

            "Action": [

                "iam:GetUser",

                "iam:ListUsers",

                "iam:GetGroup",

                "iam:ListGroups",

                "iam:ListGroupsForUser",

                "s3:ListAllMyBuckets",

                "s3:GetBucketNotification",

                "s3:GetObject",

                "s3:GetBucketLocation",

                "s3:PutBucketNotification",

                "s3:PutObject",

                "s3:GetObjectAcl",

                "s3:GetBucketAcl",

                "s3:PutBucketAcl",

                "s3:PutObjectAcl",

                "s3:DeleteObject",

                "s3:ListBucket",

                "sns:CreateTopic",

                "sns:SetTopicAttributes",

                "sns:GetTopicAttributes",

                "sns:Subscribe",

                "sns:AddPermission",

                "sns:ListSubscriptionsByTopic",

                "sqs:CreateQueue",

                "sqs:GetQueueUrl",

                "sqs:GetQueueAttributes",

                "sqs:SetQueueAttributes",

                "sqs:ChangeMessageVisibility",

                "sqs:DeleteMessage",

                "sqs:ReceiveMessage",

            "cloudtrail:DescribeTrails"

            ],

            "Effect": "Allow",

            "Resource": "*",

            "Sid": "CasbAwsDlpPolicy"

        }

    ],

    "Version": "2012-10-17"

}

5. Click Review Policy at the lower right portion of the screen.

   

6. Name the policy iam-api-policy and click Create Policy.

 

Step 7 – Create an IAM Cloud Security Posture Management (CSPM) policy

1. Click Services and select IAM.

2. Select Policies and click Create Policy.

3. Click the JSON tab.

   

4. Copy and paste the following policy information:

   {

     "Statement": [

       {

         "Action": [

           "account:*",

           "cloudhsm:AddTagsToResource",

           "cloudhsm:DescribeClusters",

           "cloudhsm:DescribeHsm",

           "cloudhsm:ListHsms",

           "cloudhsm:ListTags",

           "cloudhsm:ListTagsForResource",

           "cloudhsm:TagResource",

           "cloudtrail:AddTags",

           "cloudtrail:DescribeTrails",

           "cloudtrail:GetEventSelectors",

           "cloudtrail:GetTrailStatus",

           "cloudwatch:DescribeAlarms",

           "cloudwatch:DescribeAlarmsForMetric",

           "cloudwatch:TagResource",

           "config:Describe*",

           "dynamodb:ListStreams",

           "dynamodb:TagResource",

           "ec2:CreateTags",

           "ec2:Describe*",

           "ecs:DescribeClusters",

           "ecs:ListClusters",

           "ecs:TagResource",

           "elasticbeanstalk:AddTags",

           "elasticfilesystem:CreateTags",

           "elasticfilesystem:DescribeFileSystems",

           "elasticloadbalancing:AddTags",

           "elasticloadbalancing:DescribeLoadBalancers",

           "elasticloadbalancing:DescribeTags",

           "glacier:AddTagsToVault",

           "glacier:ListVaults",

           "iam:GenerateCredentialReport",

           "iam:Get*",

           "iam:List*",

           "iam:PassRole",

           "kms:DescribeKey",

           "kms:ListAliases",

           "kms:ListKeys",

           "lambda:ListFunctions",

           "lambda:TagResource",

           "logs:DescribeLogGroups",

           "logs:DescribeMetricFilters",

           "rds:AddTagsToResource",

           "rds:DescribeDBInstances",

           "redshift:CreateTags",

           "redshift:DescribeClusters",

           "s3:GetBucketAcl",

           "s3:GetBucketLocation",

           "s3:GetBucketWebsite",

           "s3:ListAllMyBuckets",

           "s3:ListBucket",

           "s3:PutBucketTagging",

           "sdb:ListDomains",

           "secretsmanager:ListSecrets",

           "secretsmanager:TagResource",

           "sns:GetTopicAttributes",

           "sns:List*",

           "tag:GetResources",

           "tag:GetTagKeys",

           "tag:GetTagValues",

           "tag:TagResources",

           "tag:UntagResources"

         ],

         "Effect": "Allow",

         "Resource": "*",

         "Sid": "CasbAwsCspmPolicy"

       }

     ],

     "Version": "2012-10-17"

   }

5. Click Review Policy.

6. Give the policy the name iam-cspm-policy and click Create Policy.

Step 8 – Create an IAM Key Management Service (KMS) policy

Perform the following steps if the S3 bucket has KMS enabled.

1. Click Services and select IAM.

2. Select Policies and click Create Policy.

3. Click the JSON tab.

   

4. From an S3 bucket, obtain the KMS key for the KMS policy information.

1. Click an S3 bucket.

2. Click Bucket Properties.

3. Scroll to the default encryption section and copy the AWS KMS key ARN.

   If different keys are assigned to buckets, you will need to add them under Resource in the policy information (step 5).

5. Copy and paste the following policy information:

   {

               "Sid": "VisualEditor0",

               "Effect": "Allow",

               "Action": [

                   "kms:Decrypt",

                   "kms:Encrypt",

                   "kms:GenerateDataKey",

                   "kms:ReEncryptTo",

                   "kms:DescribeKey",

                   "kms:ReEncryptFrom"

               ],

               "Resource": ["<AWS_KMS_key_ARN>"

                    ]

           }

6. Click Review Policy.

7. Give the policy the name iam-kms-policy and click Create Policy.

Step 9 – Attach the policies to the IAM role

1. In the AWS console, go to Services and select IAM.
   

2. Select Roles and search for the role that you created in Step 1 – Create an IAM role for Juniper CASB.
   

3. Click on that role and go to the Permissions tab.
   

4. Under Add permissions, select Attach policies.
   

5. Select the policies that you created in steps 5, 6, 7, and 8 earlier.
   

6. Save the role.

Onboarding steps

1. In the Juniper Management Console, go to Administration > App Management and click New.

   

2. Select AWS from the dropdown list.

3. Enter a Name (required) and a Description (optional) and click Next.

4. For the application, check Amazon Web Services and click Next.

5. Select one or more of the following protection models by clicking the toggle for each protection model to include.

• Cloud Authentication

• API Access

• Cloud Security Posture

6. Click Next.

   Notes

• To onboard AWS in API mode, choose API Access.

• Cloud Security Posture Management (CSPM) provides tools to monitor resources used in your organization and assess security risk factors against security best practices for AWS cloud applications. To enable use of CSPM, you must choose Cloud Security Posture as a protection mode.

7. If you selected API Access:

   1. Click the AWS Monitoring toggle and enter the following information in the API section of the Configuration page. This is the information you had generated in Step 2 of the configuration steps (Create an Identity Access Management (IAM) role for CASB).

      1. External ID

      2. Role ARN

      3. SQS Queue Name and SQS Region (see Step 6 – Create Simple Queue Service [SQS])
         
         

   2. In the Authentication section, click the Authorize button and click Next.

      A popup message appears prompting you to confirm that the required policies (according to the selected protection modes) are assigned to the role.

      Note: Be sure your browser is configured to allow pop-ups to be displayed.

   3. Click Continue to confirm that the required policies are displayed.

      When the authorization is complete, a green checkmark appears next to the Authorize button, and the button label now reads Re-Authorize.

   4. Click Next to display a summary of the onboarding settings.

   5. Click Save to complete onboarding.

      The new cloud application is displayed as a tile on the App Management page.