As a part of the AWS cloud provider integration, Vanta supports the detection and linking of all your AWS accounts via your AWS Organization Management account.  However we currently do not pull in resources from the management account. If you have resources you would like Vanta to monitor from your Management account, we would recommend that you connect each of your AWS accounts using the individual connection flow. 

• When connecting via your AWS Organization, Vanta will scan all the AWS accounts associated with your AWS Organization and detect when AWS accounts are added or deleted in your organization - then automatically update your inventory in Vanta. 
• If you are migrating from connecting via individual AWS accounts, please complete Delete individual AWS accounts in Vanta first.
• If this is the first time you connect Vanta with AWS, you can Prepare your AWS Environment.
• Note: We currently don’t support connecting an AWS Organization with individual AWS accounts (it’s either or), and we also don’t support connecting multiple AWS Organizations. 

Delete individual AWS accounts in Vanta

• If you have already connected AWS with Vanta by adding individual AWS accounts, you must delete those accounts before you can connect via your AWS Organization.
• If you've assigned owners or descriptions for resources within Vanta, these data will get erased when you delete your credentials. If this prevents you from migrating to AWS Organizations, please contact support.
• To delete AWS accounts, go to Integrations > Cloud Providers > Amazon Web Services > Manage > Edit > Delete (trash icon) or Delete all accounts.

Prepare your AWS environment

To prepare your AWS environment to integrate with Vanta you need to do the following two things:

• Configure each AWS account in your AWS Organization so Vanta can scan them

• Configure your Management account and connect to Vanta

In Vanta go to Integrations > Cloud providers and add AWS. In the connection flow choose to connect with "Organization"

Configure each AWS account in your AWS Organization so Vanta can scan them

Select Products

During the first connection step, You'll be prompted to select the products from AWS you'd like to connect to Vanta. The products selected may change the Policy Permission generated on the Policy Creation step. For Example, Adding the AWS CodeCommit product generates the associated permissions needed in the Policy:

Policy creation

For each account, create a policy in AWS policy creator:

• Navigate to the AWS policy creator.
  Once there, click on the JSON tab. Note: AWS inline policies are not supported.
• Paste the policy: Take the snippet in the step below and paste it into the AWS Policy editor:
   

• Review the policy and name the policy VantaAdditionalPermissions
• Click Create policy

Role creation

For each account, create a role in AWS role creator:

• • Navigate to the AWS role creator. Click "AWS Account" for "Trusted entity type" and select "Another AWS Account" for "An AWS account."
  • Paste the following value into the Account ID field

    956993596390

  • Select Require external ID and paste the following value into the field

    Get this value in the AWS connection flow in Vanta

  • Confirm that Require MFA is not selected
  • Click Next on the bottom right
•  
• Important: 
  • Select policies: Search for SecurityAudit and select the checkbox for this policy. Do the same for the VantaAdditionalPermissions a policy that we just created.
  • Click Next on the bottom right
  • Name the role vanta-auditor
    • Note: Vanta expects the roles you create for accounts in your AWS Organization to be named vanta-auditor. Other role names may prevent Vanta from being able to scan the policy.
•  
  • Click Create role
• Follow the steps in the connection flow to create a policy and role in your Management account.
  • Because Vanta scans for resources in your Management Account, you'll need to add resource scanning permissions and the SecurityAudit role to Vanta's role in your management account.

     

Configure your Management account and connect to Vanta

For your Aws Management Account, create a policy in AWS policy creator:

• Navigate to the AWS policy creator. Once there, click on the JSON tab. Note: AWS inline policies are not supported
• Paste the policy:
  Take the snippet in the step below and paste it into the AWS Policy editor:
   

• Review the policy and name the policy VantaManagementAccountPermissions
• Click Create policy

When prompted, enter the ARN of the “vanta-auditor” role you created in your Management account.

• You can select all regions where you have the infrastructure. Vanta will scan your organization for resources in all your chosen regions.
  
  
• Vanta will scan your AWS Organization for accounts and resources. It can take up to 2 hours to finish scanning.
• You can see your AWS accounts in Inventory when the scan has been completed.
• To configure the scope of your scanned resources for each AWS account, go to Integrations > Configure scope.

Updated November 16, 2023 02:47