Connect an AWS Organization

Connect an AWS Organization

Connect your entire AWS organization to expedite and automate the connection process in cloud environments with many accounts. Doing so allows you to:

Prerequisite

Onboard your organization's management account to Tenable One AI Exposure with the Connect an AWS Account account procedure.

Connect an Organization

To connect an AWS organization:

Be aware that during the wizard you will need to navigate back and forth between the AI Exposure Console and the AWS Management Console.

  1. In the AI Exposure Console, navigate to Settings > Integrations and click Add Integration.
  2. In the Integrations Library, select AWS Organization.

  3. In Select a management account, select the management account you already onboarded. See Prerequisite.

    If you did not onboard your organizations management account, it will not be displayed in the dropdown.

  4. In Organization Details, perform these steps:

    1. Verify that the Organization Name and Role Name are correct.

      Note: The Organization Name is the ID of the organization, and can be found in the AWS Organizations console. If you previously connected individual accounts to AI Exposure, make sure that the name of the IAM role you choose here is different than any role names used for those accounts. After deploying the StackSet later on in this wizard, you can safely remove any other roles that were used.

    2. Select the CloudTrail Name to be used in all member accounts, assuming you are using a default name for member accounts. If you aren't using a default name for CloudTrails in all member accounts, you can still configure CloudTrail for individual accounts, after connecting an organization. You can enter a wildcard character (*) in this field (e.g. Organization-Trail-* would select Organization-Trail-1234).

      Important: After connecting the organization, you still need to grant Tenable access to the S3 bucket containing the trail. To do so, in AI Exposure, edit the relevant account where the bucket is located and grant Tenable CloudTrail permissions via the IAM role. If the bucket is located in your management account, you may have already done this when you connected that account.

    3. Select all relevant Active Regions where you have resources deployed.

      Verify that you select only the specific regions used by your organization. Unselected regions will be ignored. Enable all regions not disabled or blocked by SCPs or RCPs for scanning. If your deployment expands to additional regions at a later stage, you will need to edit the account in AI Exposure and add those regions.

    4. Choose whether to automatically update folder structure.

      Copy your AWS organizational unit folder structure into the platform, keeping your account hierarchy intact and continuously synchronized. Learn more about account hierarchy.

  5. Click Next.
  6. In Permissions, choose which permissions to grant to Tenable that are required for different features to function. To learn more, see AWS Required Permissions.
    • Monitoring (read-only) — Gain full visibility for all cloud assets, including information about permissions, account usage, and security configurations. Additional permissions may be required to read the CloudTrail for the onboarded account.

    • Data Protection — Scan and classify cloud resources for sensitive data.

      Note: This feature is relevant if you're working with AI Exposure Data Protection. See Data Protection for more information. See Data Resources Scanning Policy (Data Protection) to view the policy in JSON format.

    • EC2 Instance and AMI Scanning (Workload and Data Protection). Scan EC2 instances and AMI (private and public machine images) for vulnerabilities, misconfigurations, secrets and sensitive data. For more information about required permissions, see the documentation.

      Important:
      • This feature is relevant if you're working with AI Exposure Workload Protection. See Workload Protection for more information. See EC2 Instance Scanning (Workload Protection) to view the policy in JSON format.
      • Tenable added exclusion rules by default to prevent scanning AMIs that are identified as backup AMIs based on their tags.

    • ECR Scanning (Workload Protection) — Scan container registries for vulnerabilities and misconfigurations.

      Relevant if you're working with AI Exposure Workload Protection (requires Standard/Enterprise license. See Workload Protection for more information. See ECR Scanning Workload Protection Policy to view the policy in JSON format.

    • Remediation (read-write) — Allow Tenable to make changes in your environment. This lets you automatically remediate findings with one click. For more information about required permissions, see the documentation.
  7. Click Next.
  8. Create an IAM Role, using CloudFormation (via either the AWS Console, or the AWS CLI):
    • CloudFormation (AWS Console):
      1. Log in to the AWS management account for your organization.
      2. Navigate to CloudFormation > StackSets.
      3. Click Create StackSet.
      4. In Step 1 (Choose a template), keep the default values in the Permissions and Prerequisite - Prepare Template sections, and, in the Specify Template section, do one of the following depending on your deployment type. For both types, use the following S3 URL / template: https://tenable-utilities.s3.us-east-2.amazonaws.com/Onboarding/AWS/CloudFormation/Template.json
        • Standard AWS Organization (Commercial): Choose Amazon S3 URL and enter the above URL.
        • AWS GovCloud (US) Organization: Choose Upload a template file. Download the above template as a JSON file, and then upload it here.
      5. Click Next.
      6. In Step 2 (Specify StackSet details), enter a StackSet name, and, optionally, a description.
      7. Enter the parameter values listed in the Add AWS Organization wizard in the AI Exposure Console.
      8. Click Next.
      9. In Step 3 (Configure StackSet options), keep the default values as they are, and click Next.
      10. In Step 4 (Set deployment options), choose either Deploy to organization or Deploy to organizational units (OUs), as relevant. Keep the other default values as they are.
      11. In the Specify Regions section, choose a single region (IAM roles aren't regional).
      12. Click Next.
      13. In Step 5 (Review), review the StackSet configurations. Select I acknowledge that AWS CloudFormation might create IAM resources with custom names and then click Submit.
      14. Wait until the Stack creation is complete. You can click on the Refresh button to track progress.
      15. [AI Exposure Console] Click Next.
    • CloudFormation (AWS CLI):
      1. Log in to the AWS management account for your organization.
      2. Open a new shell session with the latest version of the AWS CLI. Administrator privileges are required to create the CloudFormation stack
      3. Copy the command that appears in the AI Exposure Console, and run it in your shell.
    1. In the AWS Management Console, navigate to CloudFormation > StackSets and open the newly created StackSet.
    2. Wait until the Stack creation is complete. You can click on the Refresh button to track progress.
    3. [AI Exposure Console] Click Next.

  9. In Configure Scopes, choose which Organizational Units (OUs) and accounts to onboard.

    • Sync all accounts (recommended)
    • Include specific OUs and accounts
    • Exclude specific OUs and accounts
    Note: If you include/exclude an entire OU, all current and future accounts within the OU are included/excluded. If you include/exclude specific accounts, only the selected accounts will be included/excluded.
  10. Click Finish.

Next Steps

After your organization is added successfully:

  • You can see the organization in the Organization > Accounts page.
  • You can see accounts that belong to the organization in the Accounts > AWS page. From here you can manage your account and view account details to see, for example, which features are enabled and whether the required permissions were granted.

Data about account resources will start to appear in AI Exposure. The time it takes for all data to appear varies depending on the size of your cloud environment.