Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[8.16] Updates AWS CSPM guides to include agentless option #5863

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
+175 −34
Open

[8.16] Updates AWS CSPM guides to include agentless option #5863

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
69742e6
Updates AWS CSPM guides to include agentless option
benironside Sep 26, 2024
99c8b64
Creates placeholder for agentless integrations page
benironside Oct 2, 2024
b9a2f29
Update docs/cloud-native-security/cspm-get-started-aws.asciidoc
benironside Oct 2, 2024
02551f8
Update docs/serverless/cloud-native-security/cspm-get-started.mdx
benironside Oct 2, 2024
99d6284
Update docs/cloud-native-security/cspm-get-started-aws.asciidoc
benironside Oct 2, 2024
a9dbee8
Update docs/serverless/cloud-native-security/cspm-get-started.mdx
benironside Oct 2, 2024
fbcda4b
minor update
benironside Oct 2, 2024
75a273f
Adds agentless options to CSPM docs
benironside Oct 11, 2024
d45719b
Expand steps within the relevant sections
benironside Oct 22, 2024
8a76391
Adds serverless updates
benironside Oct 24, 2024
952df1f
Merge branch 'main' into 5606-cspm-agentless-onboard-beta
benironside Oct 28, 2024
6084b21
Merge branch 'main' into 5606-cspm-agentless-onboard-beta
benironside Oct 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 19 additions & 3 deletions docs/cloud-native-security/cspm-get-started-aws.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,21 @@ This page explains how to get started monitoring the security posture of your cl

You can set up CSPM for AWS either by enrolling a single cloud account, or by enrolling an organization containing multiple accounts. Either way, first you will add the CSPM integration, then enable cloud account access.

[discrete]
[[cspm-aws-agentless]]
== Agentless deployment option
benironside marked this conversation as resolved.
Show resolved Hide resolved
beta::[]

The steps to create an agentless deployment are similar to those to create an agent-based deployment. To deploy using agentless technology, follow the instructions below with the following modifications:
benironside marked this conversation as resolved.
Show resolved Hide resolved

. On the **Add Cloud Security Posture Management (CSPM) integration** page, after you name your integration and give it a description, click **Advanced options** then select **Agentless (BETA)**.
. Once you've selected **Agentless (BETA)**, you'll need to authenticate to AWS. Agentless AWS deployments support authentication via <<cspm-set-up-cloudformation, CloudFormation>>, and by two manual authentication methods: <<cspm-use-temp-credentials, temporary keys>> and <<cspm-use-keys-directly, direct access keys>>.
. Once you've selected an authentication method and provided any necessary credentials, click **Save and continue** to finish deployment.
benironside marked this conversation as resolved.
Show resolved Hide resolved

[discrete]
[[cspm-aws-agent-based]]
== Agent-based deployment

[discrete]
[[cspm-add-and-name-integration]]
== Add the CSPM integration
Expand All @@ -43,10 +58,11 @@ You can set up CSPM for AWS either by enrolling a single cloud account, or by en
[discrete]
[[cspm-set-up-cloud-access-section]]
== Set up cloud account access
The CSPM integration requires access to AWS’s built-in https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor[`SecurityAudit` IAM policy] in order to discover and evaluate resources in your cloud account. There are several ways to provide access.
The CSPM integration requires access to AWS's built-in https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor[`SecurityAudit` IAM policy] in order to discover and evaluate resources in your cloud account. There are several ways to provide access.

For most use cases, the simplest option is to use AWS CloudFormation to automatically provision the necessary resources and permissions in your AWS account. This method, as well as several manual options, are described below.


[discrete]
[[cspm-set-up-cloudformation]]
=== CloudFormation (recommended)
Expand Down Expand Up @@ -208,7 +224,7 @@ image::images/cspm-aws-auth-3.png[The EC2 page in AWS, showing the Modify IAM ro
.. Click *Update IAM role*.
.. Return to {kib} and <<cspm-finish-manual, finish manual setup>>.

IMPORTANT: Make sure to deploy the CSPM integration to this EC2 instance. When completing setup in {kib}, in the *Setup Access* section, select *Assume role* and leave *Role ARN* empty. Click *Save and continue*.
IMPORTANT: Make sure to deploy the CSPM integration to this EC2 instance. When completing setup in {kib}, in the *Setup Access* section, select *Assume role*. Leave **Role ARN** empty unless you want to specify a role the ((agent)) should assume instead of the default role for your EC2 instance. Click *Save and continue*.
benironside marked this conversation as resolved.
Show resolved Hide resolved

[discrete]
[[cspm-use-keys-directly]]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@smriti0321 I think there are a few callouts or troubleshooting guide for missing regarding Agentless Onboarding.

  • Once agentless integration has been created, then the status column which takes a few refreshes to see the updated agent count. A callout message talking about the agentless deployment experience taking a minute or two before agent is enrolled and/or ingesting data could be useful here.
  • Customer enters the wrong credentials with deployed agent. Maybe guide the customer through that experience to rectify an issue with the Edit Flow or restarting with the deletion flow then creation flow again.
  • Agent is offline or unhealthy then inform customer can still access fleets agents page or explore errors in Logs Explorer.
  • Deletion flow - warn the customer that deletion will remove resources and stop data ingestion
  • Changing the fleet server will cause breaking changes. @smriti0321 See comment.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great inputs @Omolola-Akinleye
@benironside is it possible to cover these in the FAQ for CSPM or you recommend any other place for troubleshooting agentless integrations?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the FAQ seems like a good option. Let's cover this in our next sync

Expand All @@ -222,7 +238,7 @@ IMPORTANT: You must select *Programmatic access* when creating the IAM user.
[discrete]
[[cspm-use-temp-credentials]]
=== Option 3 - Temporary security credentials
You can configure temporary security credentials in AWS to last for a specified duration. They consist of an access key ID, a secret access key, and a security token, which is typically found using `GetSessionToken`.
You can configure temporary security credentials in AWS to last for a specified duration. They consist of an access key ID, a secret access key, and a session token, which is typically found using `GetSessionToken`.

Because temporary security credentials are short term, once they expire, you will need to generate new ones and manually update the integration's configuration to continue collecting cloud posture data. Update the credentials before they expire to avoid data loss.

Expand Down
12 changes: 12 additions & 0 deletions docs/cloud-native-security/cspm-get-started-azure.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,18 @@ This page explains how to get started monitoring the security posture of your cl
You can set up CSPM for Azure by by enrolling an Azure organization (management group) containing multiple subscriptions, or by enrolling a single subscription. Either way, first add the CSPM integration, then enable cloud account access.


[discrete]
[[cspm-azure-agentless]]
== Agentless deployment option
beta::[]

The steps to create an agentless deployment are similar to those to create an agent-based deployment. To deploy using agentless technology, follow the instructions below with the following modifications:

. On the **Add Cloud Security Posture Management (CSPM) integration** page, after you name your integration and give it a description, click **Advanced options** then select **Agentless (BETA)**.
. Once you've selected **Agentless (BETA)**, you'll need to authenticate to Azure. Agentless Azure deployments support authentication via the <<cspm-azure-client-secret, Service principal with client secret>> method described below.
. Once you've selected an authentication method and provided any necessary credentials, click **Save and continue** to finish deployment.


[discrete]
[[cspm-add-and-name-integration-azure]]
=== Add your CSPM integration
Expand Down
14 changes: 14 additions & 0 deletions docs/cloud-native-security/cspm-get-started-gcp.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,20 @@ This page explains how to get started monitoring the security posture of your GC

You can set up CSPM for GCP either by enrolling a single project, or by enrolling an organization containing multiple projects. Either way, you need to first add the CSPM integration, then enable cloud account access.

[discrete]
[[cspm-gcp-agentless]]
== Agentless deployment option
beta::[]

The steps to create an agentless deployment are similar to those to create an agent-based deployment. To deploy using agentless technology, follow the instructions below with the following modifications:

. On the **Add Cloud Security Posture Management (CSPM) integration** page, after you name your integration and give it a description, click **Advanced options** then select **Agentless (BETA)**.
. Once you've selected **Agentless (BETA)**, click **Steps to Generate GCP Account Credentials** under **Setup Access**. Follow the instructions that appear to generate the necessary GCP credentials.
. Once you've entered your credentials under **Credentials json**, click **Save and continue** to deploy your integration.

[discrete]
[[cspm-gcp-agent-based]]
== Agent-based deployment

[discrete]
[[cspm-add-and-name-integration-gcp]]
Expand Down
2 changes: 1 addition & 1 deletion docs/cloud-native-security/cspm.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

The Cloud Security Posture Management (CSPM) feature discovers and evaluates the services in your cloud environment — like storage, compute, IAM, and more — against configuration security guidelines defined by the https://www.cisecurity.org/[Center for Internet Security] (CIS) to help you identify and remediate risks that could undermine the confidentiality, integrity, and availability of your cloud data.

This feature currently supports Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. For step-by-step getting started guides, refer to <<cspm-get-started,Get started with CSPM for AWS>>, <<cspm-get-started-gcp, Get started with CSPM for GCP>>, or <<cspm-get-started-azure, Get started with CSPM for Azure>>.
This feature currently supports agentless and agent-based deployments on Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure. For step-by-step getting started guides, refer to <<cspm-get-started,Get started with CSPM for AWS>>, <<cspm-get-started-gcp, Get started with CSPM for GCP>>, or <<cspm-get-started-azure, Get started with CSPM for Azure>>.

.Requirements
[sidebar]
Expand Down
10 changes: 10 additions & 0 deletions docs/getting-started/agentless-integrations.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
[[agentless-integrations]]
= Agentless integrations

beta::[]

Agentless integrations provide a means to ingest data while avoiding the orchestration, management, and maintenance needs associated with standard ingest infrastructure. Using agentless integrations makes manual agent deployment unnecessary, allowing you to focus on your data instead of the agent that collects it.

We currently support one agentless integration: cloud security posture management (CSPM). Using this integration's agentless deployment option, you can enable Elastic's CSPM capabilities just by providing the necessary credentials. Agentless CSPM deployments support AWS, Azure, and GCP accounts.

To learn more about agentless CSPM deployments, refer to the getting started guides for CSPM on <<cspm-get-started, AWS>>, <<cspm-get-started-azure, Azure>>, or <<cspm-get-started-gcp, GCP>>.
1 change: 1 addition & 0 deletions docs/getting-started/index.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ include::security-ui.asciidoc[leveloffset=+1]
include::ingest-data.asciidoc[leveloffset=+1]
include::threat-intel-integrations.asciidoc[leveloffset=+2]
include::automatic-import.asciidoc[leveloffset=+2]
include::agentless-integrations.asciidoc[leveloffset=+2]

include::security-spaces.asciidoc[leveloffset=+1]

Expand Down
12 changes: 10 additions & 2 deletions docs/serverless/cloud-native-security/cspm-get-started.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,14 +41,22 @@ You can set up CSPM for AWS either by enrolling a single cloud account, or by en
1. Click **Add Cloud Security Posture Management (CSPM)**.
1. Select **AWS**, then either **AWS Organization** to onboard multiple accounts, or **Single Account** to onboard an individual account.
1. Give your integration a name that matches the purpose or team of the AWS account/organization you want to monitor, for example, `dev-aws-account`.
1. <DocBadge template="beta" /> (Optional) Click **Advanced settings** to deploy the integration using agentless technology.


<div id="cspm-set-up-cloud-access-section"></div>

## Set up cloud account access
The CSPM integration requires access to AWS’s built-in [`SecurityAudit` IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor) in order to discover and evaluate resources in your cloud account. There are several ways to provide access.
The CSPM integration requires access to AWS's built-in [`SecurityAudit` IAM policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_job-functions.html#jf_security-auditor) in order to discover and evaluate resources in your cloud account. There are several ways to provide access.

For most use cases, the simplest option is to use AWS CloudFormation to automatically provision the necessary resources and permissions in your AWS account. This method, as well as several manual options, are described below.

<DocCallOut title="Note">
<DocBadge template="beta" /> Agentless deployments support two authentication methods:
<DocLink slug="/serverless/security/cspm-get-started" section="option-2-direct-access-keys">Direct access keys</DocLink> and <DocLink slug="/serverless/security/cspm-get-started" section="option-3-temporary-security-credentials">Temporary keys</DocLink>.
</DocCallOut>


<div id="cspm-set-up-cloudformation"></div>

### CloudFormation (recommended)
Expand Down Expand Up @@ -222,7 +230,7 @@ Follow AWS's [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/lates
1. Return to ((kib)) and <DocLink slug="/serverless/security/cspm-get-started" section="finish-manual-setup">finish manual setup</DocLink>.

<DocCallOut title="Important" color="warning">
Make sure to deploy the CSPM integration to this EC2 instance. When completing setup in Kibana, in the **Setup Access** section, select **Assume role** and leave **Role ARN** empty. Click **Save and continue**.
Make sure to deploy the CSPM integration to this EC2 instance. When completing setup in Kibana, in the **Setup Access** section, select **Assume role**. Leave **Role ARN** empty unless you want to specify a role the ((agent)) should assume instead of the default role for your EC2 instance. Click **Save and continue**.
</DocCallOut>

<div id="cspm-use-keys-directly"></div>
Expand Down
Loading