AWS FAQ and Troubleshooting

Even though you may have granted Tenable all required permissions within regions that your organization is using, since some AWS services are global, Tenable must have permissions to query the global endpoint (us-east-1). For more information, refer to relevant AWS documentation here{target=_blank} and here{target=_blank}.

If you use service control policies (SCPs) in your AWS organization, make sure to add exclusions to any existing SCP to ensure that the dedicated IAM role you create for Tenable is not included.

Generally speaking, AI Exposure only pulls information via the API. However, some data (for example, Lambda triggers and AWS SSO) is not available using Amazon’s publicly documented API. To get this information, Tenable uses API calls that are typically used by the AWS console, resulting in the alerts that you're seeing. These are essentially undocumented APIs. The alerts are completely normal, and are in fact the expected behavior. Tenable never accesses your console manually at any point. All access is strictly via the API.

To modify your organization's scope and remove specific entities:

1. In the Console, navigate to Settings > Integrations.
2. Click on the three dots menu next to the organization, and click Edit.
3. Click Next to navigate to the last step in the wizard (Scopes).
4. Select Exclude specific OUs and accounts and then select the relevant OU or account.
5. Click Finish. It will be removed from the Console the next time Tenable syncs data in your environment.

The Elastic Beanstalk configuration is stored in an S3 bucket. As a result, there is no alternative way of accessing configuration for this service other than via this permission.

Tenable continuously adds new features and functionality to its offering. To support this, the custom inline policy is updated by Tenable from time to time. The SecurityAudit policy contains an even broader permission set, and, together with the inline policy, ensures support for the rapidly expanding set of features that are added to AI Exposure. To ensure complete and ongoing support for all current and future functionality in Tenable, and to give you the flexibility of not having to constantly track/update the permission set, both policies are needed. For step-by-step guidance on resolving AWS role and permission errors, see Resolve Cloud Onboarding Permission and Role Errors (AWS, Azure, GCP).

As soon as the new services or permissions become available, but it may take up to one week before they are displayed in the AI Exposure Console. The process of detecting such changes is done programmatically, and not manually.

Yes. This is useful if you have multiple organizations and want clearer identification.

To update the name:

1. In the AI Exposure Console, navigate to Settings > Integrations.
2. Next to the relevant integration, click the three dots menu, and then Edit.
3. Navigate to step 2 in the wizard and update the Organization Name field.
4. Click Next to navigate to the last step in the wizard and then click Update.

To keep your inventory focused and up to date, Tenable only synchronizes Task Definitions that meet at least one of the following criteria:

• The status is Active.
• The definition is Inactive but is currently referenced by an active ECS service or task.

Inactive and unused Task Definitions are automatically excluded from the inventory to ensure your data reflects your actual attack surface. Any findings associated with these excluded resources are automatically closed.

AI Exposure requires the continuous auditing of management events in all regions for, among other reasons, the ability to recommend removing unused permissions. To provide such recommendations with complete confidence, Tenable needs visibility into the full range of logs, across the entire environment, to ensure that such actions/permissions aren't being used.