Release Version	Published Date	Notes
Archer 6.7	July 2024	Resigned JavaScript file
Archer 6.7	December 2021	Resigned JavaScript file
Archer 6.7	February 2020	Initial Release

Overview

AWS IAM Access Analyzer integration informs which resources in your account that are sharing with external principals as per the configured IAM policies. It does this by using logic-based reasoning to analyze resource-based policies in your AWS environment. An external entity can be another AWS account, a root user, an IAM user or role, a federated user, an AWS service, an anonymous user, or other entity that you can use to create a filter. Access Analyzer generates a finding for each instance of a resource-based policy that grants access to a resource in your zone of trust (your account) to an external entity.

When analyzing the policies, if Access Analyzer identifies one that grants access to an external principal that isn't within zone of trust, it generates a finding. Each finding includes details about the resource, the external entity that has access to it, and the permissions granted so that you can take appropriate action.

Key features & benefits

The AWS IAM Access Analyzer Integration with Archer allows you to automatically import finding data directly into on-demand applications for Cloud Risk Monitoring. The integration allows users to view findings linked to the cloud resources. The integration then delivers the tools you need to analyze these findings, automatically notify responsible personnel, and proactively address issues before they impact your organization.  Additionally, Archer produces real-time reports and user-specific dashboards to view these findings and their impact to your organization, and to monitor the overall status of your cloud risk monitoring program.

Requirements

Components	Requirement
Archer Solution	Archer IT & Security Risk Management
Archer use cases	The following use cases can take advantage of the information provided by the AWS IAM Access Analyzer integration: (Optional) Archer IT Risk Management Archer IT Controls Assurance Archer IT Security Vulnerability Program Archer Cyber Incident & Breach Response Archer Information Security Management System (ISMS) Archer PCI Management
Requires On-Demand license	Yes. Requires two (2) On-Demand Applications license.
On-Demand Applications	Two On-Demand Applications are required. Potential Unauthorized Activity Cloud Assets and Services
Prerequisite applications	Requirements for the installation and operation of this integration includes the following applications: Exception Requests – Archer Issues Management Remediation Plans – Archer Issues Management
Archer requirements	Archer release 6.7 or later
AWS IAM Access Analyzer requirements	Valid AWS IAM Access Analyzer license is required.
Supported Platform version	This offering has been developed for and validated on Archer Platform release 6.7.

Components

Architecture diagram

Integration diagram

The following diagram provides an overview of the interaction between AWS IAM Access Analyzer and Archer.

The integration process follows the following flow:

1. The Archer data feed for the AWS IAM Access Analyzer Integration pulls the findings data from the source: AWS IAM Access Analyzer and imports the data into Target: Potential Unauthorized Activity and Cloud Assets and Services ODA.

2. When the user logins into the AWS IAM Access Analyzer URL, a list of all the findings and a list of resources in your account that you are sharing with external principals available are visible.

Install & configure AWS IAM Access Analyzer

Configure AWS IAM Access Analyzer

This section provides instructions for configuring the AWS IAM Access Analyzer offering with the Archer Platform.  This document is not intended to suggest optimum installations or configurations. 

It is assumed that the reader has both working knowledge of all products involved, and the ability to perform the tasks outlined in this section. Administrators should have access to the product documentation for all products to install the required components.

All AWS IAM Access Analyzer endpoint links must be working prior to the integration. Perform the necessary tests to confirm that this is true before proceeding. 

Important: The integration described in this guide is being provided as a reference implementation for evaluation and testing purposes.  It may or may not meet the needs and use cases for your organization.  If additional customizations or enhancements are needed, it is recommended that customers contact Archer Help for assistance.

Access Analyzer analyzes only policies that are applied to resources in the same AWS Region in which it is enabled. To monitor all resources in your AWS environment, you must create an analyzer to enable Access Analyzer in each Region where you're using supported AWS resources.

Configure Archer

1. Prepare for the installation.

   1. Download the installation package from myArcher.

   2. Read and understand the "Packaging Data" section of Archer Help.

   3. Apply the latest license file by opening the Archer Control Panel.

2. Install the package. (If you are upgrading from ODA applications, they will be automatically converted to licensed applications during the installation process.)
   

3. Test the installation. Test the application according to your company standards and procedures, to ensure that the use case works with your existing processes.

Install the package

Installing a package requires that you import the package file, map the objects in the package to objects in the target instance, and then install the package.

Configure the AWS IAM Access Analyzer Data Feed

AWS IAM Access Analyzer Data Feed is a JavaScript transporter data feed that retrieves data (Findings and Resource-related data) from the AWS IAM Access Analyzer API URL and creates and updates the records in the Archer Potential Unauthorized Activity and Cloud Assets and Services application.

The data feed must be configured. After setting up the data feed, you can schedule them to run as needed per your organization’s requirements. For more information on Scheduling Data Feeds, see the Scheduling Data Feeds section.

Configure the JavaScript Transporter settings

1. In the Archer Control Panel, on the General tab, go to the JavaScript Transporter section.

   1. Open the Archer Control Panel.

   2. Go to Instance Management and select All Instances.

   3. Select the instance you want to use.

   4. On the General tab, go to the JavaScript Transporter section.

2. In the Max Memory Limit field, set the value to 2048 MB (2 GB).

3. In the Script Timeout field, set the value to 120 minutes (2 hours).

4. (Optional) If you want to allow only digitally signed JavaScript files in the data feed, enable Require Signature.

   1. In the JavaScript Transporter Settings section, select the checkbox Require Signature. A new empty cell appears in the Signing Certificate Thumbprints section

   2. In the Signing Certificate Thumbprints section, double-click an empty cell.

   3. Enter the digital thumbprint of the trusted certificate used to sign the JavaScript file.

      Note: For information on how to obtain digital thumbprints, see Obtaining Digital Thumbprints.

      Important: If you enable Require Signature and specify no thumbprints, no JavaScript files will be accepted by the system.

   4. (Optional) If you want to add additional thumbprint sources, repeat steps b-c for each thumbprint.

5. On the toolbar, click Save.

Obtain Digital Thumbprints

When running JavaScript data feeds, you can set the Archer instance to only allow digitally signed JavaScript files from trusted sources for security considerations.

For a certificate to be trusted, all the certificates in the chain, including the Root CA Certificate and Intermediate CA certificates, must be trusted on both the Web Server and Services Server machines.

Archer Technologies LLC cert in the Trusted Root CA Store

Archer Technologies LLC certificate is not present on every machine’s root by default.

1. On the JavaScript file, right-click and select Properties.

   1. Click the Digital Signatures tab.

   2. From the Signature List window, select Archer Technologies LLC.

   3. Click the Details button.

   4. Click View Certificate.

   5. Click Install Certificate.

   6. Select Local Machine.

   7. Click Next.

   8. Select Place all certificates in the following store and click Browse.

      1. Select Trusted Root Certification Authorities and click OK.

      2. Click Next.

      3. Click Finish.

2. Upon successful import, click OK.

Obtain a Certificate Thumbprint

1. In the Archer Control Panel environment, open the Manage Computer Certificates program.

   1. Click Start.

   2. Type: certificate

   3. From the search results, click Manage Computer Certificates.

2. Ensure that your trusted source certificates are in the Certificates sub-folder of the Trust Root Certification Authorities folder.

3. In the Certificates sub-folder, double-click the Archer Technologies LLC certificate that contains the thumbprint you want to obtain.

4. Verify that the certificate is trusted.

   1. In the Certificate window, click the Certification Path tab.

   2. Ensure that the Certificate Status windows displays the following message:

      This certificate is OK

      Note: If the Certificate Status windows displays something different, follow the on-screen instructions.

5. Obtain the trusted certificate thumbprint.

   1. In the Certificate window, click the Details tab.

   2. Select the Thumbprint field. The certificate's digital thumbprint appears in the window.

   3. Copy the thumbprint.

Set up the AWS IAM Access Analyzer Data Feeds

Important: For more information, see Configure the JavaScript Transporter Settings.

1. In the Archer Control Panel, go to the Manage Data Feeds page.

   1. From the menu bar, click .

   2. Under Integration, click Data Feeds.

2. Locate and select the: AWS IAM Access Analyzer Data Feed.

   Note: If you are unable to locate the Data Feed. Revisit the package installation section and make sure the data feed component has been included during the installation of the package.

3. Click Open.

4. In the General Information section, in the Status field, select Active.

5. Click the Transport tab.

6. In the Transport Configuration section, do the following:

   1. Click Upload

   2. From the Upload JavaScript File dialog, click Add New.

   3. Locate and select the signed-AWSIAMAccessAnalyzer.js file.

   4. Click Open.

   5. From the Upload JavaScript File dialog, click OK.

7. In the Custom Parameters section, enter key values. The following table describes the value for each key in Custom Parameters.

Key	Value
apiSecret	[Valid value] Default = [empty] (Required)
apiCredential	[Valid value] Default = [empty] (Required)
region	[Valid value] Default = [empty] (Required)
Proxy	[Valid value] Default = [empty] (Optional)

8. The additional parameter shown below provides valid options for the Custom Parameters section for the current JavaScript file.

Key	Value
verifyCerts	[Valid value of true/false] Default = False

9. The additional parameter shown below provides valid Filter options for the Custom Parameters section for the current JavaScript file. All the Filter Options are internally using Contains operator and are Case Sensitive. To filter the data on multiple values, use comma (“,”) as a separator. For Example, to fetch Findings of status “ACTIVE” and “RESOLVED” from AWS Access Analyzer use Filter with “status” as a Key and Value as ACTIVE, RESOLVED. Below are the supported filter types.

Key	Value
resource	[Valid value] Default = [empty] (Optional)
status	[Valid value] Default = [empty] (Optional)
resourceType	[Valid value] Default = [empty] (Optional)
principalAWS	[Valid value] Default = [empty] (Optional)
principalFederated	[Valid value] Default = [empty] (Optional)
principalCanonicalUser	[Valid value] Default = [empty] (Optional)
conditionCognitoIdentity	[Valid value] Default = [empty] (Optional)
conditionGoogleAccount	[Valid value] Default = [empty] (Optional)
conditionPrincipalArn	[Valid value] Default = [empty] (Optional)
conditionPrincipalOrgID	[Valid value] Default = [empty] (Optional)
conditionSourceAccount	[Valid value] Default = [empty] (Optional)
conditionSourceArn	[Valid value] Default = [empty] (Optional)
conditionSourceIp	[Valid value] Default = [empty] (Optional)
conditionSourceVpc	[Valid value] Default = [empty] (Optional)
conditionSourceVpce	[Valid value] Default = [empty] (Optional)
conditionUserId	[Valid value] Default = [empty] (Optional)
conditionFacebookapp_id	[Valid value] Default = [empty] (Optional)
conditionkmsCallerAccount	[Valid value] Default = [empty] (Optional)
conditionEventSourceToken	[Valid value] Default = [empty] (Optional)
conditionS3encryptionid	[Valid value] Default = [empty] (Optional)
conditionAmazonapp_id	[Valid value] Default = [empty] (Optional)
error	[Valid value] Default = [empty] (Optional)

For each key type, determine whether you want it to be Protected or Plain Text. Selecting Protected encrypts the key value for the specified key in the log. In the Data Feed Setup window, verify that the key fields are present.

10. Click Save.

    Steps 11, 12, and 13 are optional steps and only needed to troubleshoot or cross verification Field mapping of source and target fields will be pre-configured with the imported data feed.

11. Click the Data Map tab.

12. In the Field Map sub-tab, configure all the source fields (new and modified) to the target Control Standards fields.

Source Field	Target Field
Actions->Action	Actions
AnalyzedAt	Last Observed Date
Analyzer_Name	AWS Access Analyzer Name
Resource->accountid	AWS Account ID (Zone Of Trust)
Conditions->Condition->Label	Condition: Label
Conditions->Condition->Value	Condition: Value
Source	Condition: Source
UpdatedAt	Condition: Last Updated At
Created_Date	Created Date
Description	Description
Error	Error Information
Finding_ID	ID
Principals->Principal->Id	Principal ID
Principals->Principal->Type	Principal Type
Public_Access	Public Access
Region	Cloud Asset or Service Name: Region
Resources-> accountid	Cloud Asset or Service Name: Account ID
Resources-> partition	Cloud Asset or Service Name: Partition
Resources-> region	Cloud Asset or Service Name: Region
Resources-> resourcearn	Cloud Asset or Service Name: Cloud Asset Or Service ID
Resources-> resourcename	Cloud Asset or Service Name: Resource Name
Resources-> service	Cloud Asset or Service Name: Service Type
Resources-> Source	Cloud Asset or Service Name: Last Updated By
Resources-> Type	Cloud Asset or Service Name: Resource Type
Resources-> UniqueKey	Cloud Asset or Service Name: Cloud Asset Or Service Unique Key
Source	Source
Status	AWS Record State
Title	Title
UpdatedAt	Last Updated Date

13. In the Key Field Definitions Sub tab, add the “ID” as key field for Control Standards and Sub-Obligations.

Note: AWS IAM Access Analyzer enables per account per region basis. In each region, in the case of IAM roles - findings information is duplicated. If a customer tries to fetch the findings information from all the regions into Cloud Risk Monitoring on-demand applications by using multiple data feeds, roles findings information will be duplicated by default. To avoid the duplicated information, Customer needs to use the filter by Resource types

Schedule Data Feeds

When you schedule a data feed, the Data Feed Manager validates the information. If any information is invalid, an error message will display. You can save the data feed and correct the errors later, but that data feed is not processed until the errors are rectified.

Important: A data feed must be active and valid to successfully run.

1. Go to the Schedule tab of the data feed that you want to modify.

   1. From the menu bar, click .

   2. Under Integration, click Data Feeds.

   3. Select the data feed you want to modify.

   4. Click the Schedule tab.

2. In the Recurrences section, enter the frequency, start and stop times, and time zone for the data feed.

3. (Optional) In the Run Data Feed Now section, click Start to override the data feed schedule and run the data feed immediately. 

4. Click Save.

               The following table describes the fields in the Recurrences section.

Field	Description
Frequency	Specifies the interval in which the data feed runs. By minute: Runs the data feed by the minute interval set. For example, if you specify 45 in every list, the data feed executes every 45 minutes. Hourly: Runs the data feed by the hourly interval set. For example, every hour (1), every other hour (2), and so forth. Daily: Runs the data feed by the daily internal set. For example, every day (1), every other day (2), and so forth. Weekly: Runs the data feed based on a specified day of the week. For example, every Monday of the first week (1), every other Monday (2), and so forth. Monthly: Runs the data feed based on a specified week of the month. For example, 1st, 2nd, 3rd, 4th, or Last. Reference: Runs a specified data feed as runs before the current one. This option indicates to the Data Feed Service that this data feed starts as soon as the referenced data feed completes successfully. From the Reference Feed list, select after which existing data feed the current data feed starts. A reference data feed will not run when immediately running a data feed. The Data Feed Now option only runs the current data feed.
Every	Specifies the interval of the frequency in which the data feed runs.
Start Time	Specifies the time the data feed begins running.
Start Date	Specifies the date on which the data feed schedule begins.
Time Zone	Specifies the time zone in of the server that runs the data feed.

5. Test the data feed to ensure that all finding details from AWS IAM Access Analyzer were imported into the Potential Unauthorized Activity and Cloud Assets and Services application. If testing fails, try verifying the data feed and rerun. If you experience multiple failures, please contact your Archer Help.

Certification environment

Date tested: February 2020

Product name	Version information	Operating System
Archer Suite	Release 6.7 and later	Virtual Appliance
AWS IAM Access Analyzer	NA	NA