Amazon Web Services

Amazon Web Services is so far the platform of choice for hosting applications and delegating IT administration tasks. It helps save on maintenance costs of on-premises servers and provides cloud computing resources to cater to your company needs.

Cygna Auditor for AWS enables you to track changes to Amazon Identity and Access Management (IAM) configuration, that is an integral part of AWS infrastructure. For a list of monitored events and objects, see AWS Key Events & Activities.

Start Collecting Data

By default, Cygna Auditor audits the entire IAM but you can configure it to collect data from a single IAM as several collectors, for example, set up data collection for each AWS region within your IAM separately.

  1. On the Cygna Auditor home page, click the Configuration tile and then drill-down to Amazon Web Services Configuration.
  2. Click to add a new AWS configuration.
  3. Complete the auditing configuration:

    OPTION

    DESCRIPTION

    The General step

    Enable this collection Select the toggle to turn on data collection. You can disable data polling any time without deleting a collector.
    Name Add a name to distinguish one AWS collector from the other. This name will be used internally in Cygna Auditor
    Description (Optional) Add there any further details about current configuration.
    The Amazon API Credentials step

    Access key

    Secret key

    Provide your AWS authentication keys, check your AWS account for more information.
    Authorized region Select an Amazon region where your services reside. This region will be used to provide initial access to the AWS API and continue with the configuration steps. It must be a region authorized for the Amazon account.
    Verify connectivity

    Click to check that the AWS API functions for Elastic Cloud Compute (EC2) and Cloud Trail are accessible. These functions are used during configuration and data collection. The connectivity is checked for each region authorized for the account.

    If you have configured proxy settings, those settings will be used to test connectivity. If a proxy server is used without those proxy settings, access has to be provided outside of Cygna Auditor.

    The Collector Settings step

    Collection Interval

    Specify the duration (in minutes) between event collections.

    Initial Collection Interval

    Specify the length (in days) of the event backlog to collect the first time the collector runs.

    Store Interval

    Specify the amount of time (in seconds) the collector queues events for storage in the database. The default is recommended.

    Enabled Regions

    Specify one or more regions for data collection provided they are authorized for your Amazon account.

    Note: If internet connectivity is not available at this point, the drop-down list will show all AWS regions. However, region authorization and internet connectivity will have to be provided to perform event collection.

    The Ignored Events step

    Ignored Events list

    Add the names of events you wish to ignore during event collection.

    By default, Cygna Auditor suggests to ignore some common “noise” events. These entries can be retained or discarded.

    The Summary step

    Summary

    Review the data collection details before saving them.

Note: Make sure Cygna Auditor has access to *.amazonaws.com (GET and POST).