Accenture MDR Quick Start Guide in Configuring IAM User and KMS Key Policies

This quick start guide will help Accenture MDR customers in Configuring IAM User and KMS Key Policies required for AWS collectors.

The document includes the following topics:

1 IAM User Policies
2 KMS Key Policies:

Note: If using role-based access control(RBAC), no need to configure IAM user policies. That is taken care of by cloud formation template. Configure only KMS Key Policies if the SQS queue is encrypted.

Note: Please replace placeholders<.> with the actual values.

IAM User Policies

Following IAM user policies are required for S3 and SQS if using SQS(S3 via SQS) as a log collection method.

IAM User Permission for S3:

{
"Effect": "Allow",
"Action": ["s3:ListBucket","s3:GetObject"],
"Resource": ["arn:aws:s3:::<bucketname>", "arn:aws:s3:::<bucketname>/*"],
"Condition": {}
}

IAM User Permission for SQS:

{
“Action”: [
“sqs:GetQueueAttributes”,
“sqs:GetQueueUrl”,
“sqs:ReceiveMessage”,
“sqs:DeleteMessage”,
“sqs:ListQueues"
],
“Effect”: “Allow”,
“Resource”: “arn:aws:sqs:<region>:<accountID>:<SQSName>”
}

Following IAM user policy is required for cloudwatch logs if using CloudWatchLog as a log collection method:

IAM User Permission for cloudwatch:

{
"Effect": "Allow",
"Action": [
"logs:describeLogGroups",
"logs:describeLogStreams",
"logs:filterLogEvents",
"logs:getLogEvents"
],
"Resource": [
"arn:aws:logs:<region>:<accountID>:<log-group>:<specificLogGroupName>"
]
}

Following IAM user policy is required when S3 or/and SQS is encrypted.

Note: If separate keys are used to encrypt S3 and SQS, add the below policy twice with the separate key resources. If the same key is used to encrypt S3 and SQS, add the below policy only once.

IAM User Permission for KMS:

KMS Key Policies:

Following KMS key policy is required when SQS is encrypted.

Note: Replace <KEY_ARN> placeholder in the below policy with the actual key ARN used to encrypt the SQS.

KMS Key Permission for S3 to access encrypted SQS: