Fortinet black logo

Version:

Version:

Version:

Version:


Table of Contents

Online Help

Appendix A - Workload Protection Amazon Policy Usage

Communication between AWS and FortiCWP requires granting FortiCWP with permissions to access AWS account resource configuration settings. The method is done through creating custom policy on AWS in JSON format in AWS  for .

Below are lists of the AWS services/policies used and the corresponding reasoning to be used in FortiCWP.

FortiCWP Basic Permission

Service Policy in JSON Format Permission Purpose
RDS

"rds:Describe*"

"rds:DownloadDBLogFilePortion"

"rds:ListTagsForResource"

1. FortiCWP Resource List

2. RDS profile

3. RDS Topology

4. RDS Risk assessment

"rds:ModifyDBInstance" 1. Allow autofix feature of RDS Risk assessment policy "RDS instances should not be publicly accessible".
EFS "elasticfilesystem:Describe*"

1. FortiCWP Resource List

2. EFS profile

3. EFS Risk assessment

ELB "elasticloadbalancing:Describe*"

1. FortiCWP Resource List

2. Listener, Load Balancer, Target Group profile

3. ELB Topology

4. ELB Risk assessment

"elasticloadbalancing:ModifyLoadBalancer Attributes" 1. Allow autofix feature of ELB Risk assessment policy "ELB/ALB deletion protection should be enabled".
Certificate Manager

"acm:List*"

"acm:Describe*"

1. FortiCWP Resource List

2. ACM Certificate profile

3. ACM Certificate Risk assessment

CloudFront

"cloudfront:List*"

"cloudfront:Get*"

1. FortiCWP Resource List

2. CloudFront profile

3. CloudFront Risk assessment

"cloudfront:UpdateDistribution" 1. Allow autofix feature of CloudFront Risk assessment policy "CloudFront should use secure ciphers for distribution".
EKS

"eks:ListUpdates"

"eks:DescribeUpdate"

"eks:DescribeCluster"

"eks:ListClusters"

1. FortiCWP Resource List

2. EKS profile

3. EKS Topology

KMS

"kms:List*"

"kms:Describe*"

"kms:Get*"

1. FortiCWP Resource List

2. KMS Key profile

3. KMS Risk assessment

  "kms:EnableKeyRotation" 1. Allow autofix feature of KMS Risk assessment policy "KMS key rotation should be enabled".
Lambda

"lambda:List*"

"lambda:GetPolicy"

1. FortiCWP Resource List

2. Lambda profile

3. Lambda Risk assessment

SQS

"sqs:ReceiveMessage"

"sqs:GetQueueUrl"

"sqs:GetQueueAttributes"

"sqs:ListQueueTags"

"sqs:ListQueues"

"sqs:ListDeadLetterSourceQueues"

1. FortiCWP Resource List

2. SQS profile

3. SQS Risk assessment

 

"sqs:TagQueue"

"sqs:UntagQueue"

"sqs:ChangeMessageVisibility

"sqs:ChangeMessageVisibilityBatch"

"sqs:CreateQueue"

"sqs:DeleteMessage"

"sqs:DeleteMessageBatch"

"sqs:DeleteQueue"

"sqs:PurgeQueue"

"sqs:SendMessage"

"sqs:SendMessageBatch"

"sqs:SetQueueAttributes"

1. FortiCWP Notification’s integration with AWS SQS service
IAM

"iam:List*"

"iam:SimulateCustomPolicy"

"iam:GenerateCredentialReport"

"iam:Get*"

"iam:SimulatePrincipalPolicy"

1. FortiCWP Resource List

2. IAM profile

3. IAM Risk assessment

"iam:UpdateAccountPasswordPolicy" 1. Allow autofix feature of Redshift Risk assessment policy "Password requirements should be enforced".
Redshift "redshift:Describe*"

1. FortiCWP Resource List

2. Redshift profile

3. Redshift Risk assessment

"redshift:Describe*"

"redshift:ModifyClusterParameterGroup"

1. Allow autofix feature of Redshift Risk assessment policy "Redshift database should use SSL for connections".
Elastic Container Service "ecs:Describe*" "ecs:List*"

1. FortiCWP Resource List

2. ECS profile

3. ECS Topology

EC2

"ec2:Describe*

"ec2:SearchTransitGatewayRoutes

"ec2:GetTransitGatewayAttachmentPropagations

"ec2:GetTransitGatewayRouteTablePropagations

"ec2:GetTransitGatewayRouteTableAssociations"

1. FortiCWP Resource List

2. VPC, Route Table, Subnet, Network ACL, Security Group, Machine Image(AMI), EC2, EBS volume, EBS snapshot profile

3. VPC, Subnet, Network ACL, Security Group, EC2 Topology

4. VPC, Subnet, Security Group, AMI, EC2, EBS Risk assessment

 

"ec2:ModifySnapshotAttribute"

"ec2:RevokeSecurityGroupEgress

"ec2:RevokeSecurityGroupIngress"

1. Allow autofix feature of EBS Risk assessment policy "EBS snapshots should not be publicly accessible".

2. Allow autofix feature of Security Group Risk assessment policy "Default Security Group should block all inbound traffic".

CloudWatch Logs

"logs:Get*"

"logs:Describe*"

"logs:FilterLogEvents"

1. Feature "Traffic" on FortiCWP
Glacier

"glacier:ListVaults"

"glacier:GetVaultAccessPolicy"

1. FortiCWP Resource List

2. Glacier profile

3. Glacier Risk assessment

CloudFormation

"cloudformation:ListStack*"

"cloudformation:GetTemplate"

"cloudformation:DescribeStack*"

1. FortiCWP Resource List

2. CloudFormation profile

3. CloudFormation Risk assessment

S3

"s3:GetBucket*"

"s3:GetReplicationConfiguration"

"s3:GetLifecycleConfiguration"

"s3:GetInventoryConfiguration"

"s3:ListBucket"

"s3:ListBucketMultipartUploads

"s3:GetAccountPublicAccessBlock"

"s3:ListAllMyBuckets"

"s3:GetObjectVersion"

"s3:GetObjectVersionTagging"

"s3:GetObjectAcl"

"s3:GetObjectVersionAcl"

"s3:HeadBucket"

"s3:ListMultipartUploadParts"

"s3:GetObject"

"s3:GetAnalyticsConfiguration

"s3:GetObjectVersionForReplication"

"s3:ListBucketByTags"

"s3:ListBucketVersions"

"s3:GetAccelerateConfiguration"

"s3:GetObjectVersionTorrent"

"s3:GetEncryptionConfiguration"

"s3:GetObjectTagging"

"s3:GetMetricsConfiguration"

"s3:GetObjectTorrent"

1. FortiCWP Resource List

2. S3 bucket profile

3. S3 Risk assessment

4. Feature "Buckets" on FortiCWP

"s3:PutBucketVersioning"

"s3:PutBucketAcl"

"s3:PutBucketPolicy"

"s3:PutObjectAcl"

"s3:PutObjectVersionAcl"

1. Allow autofix feature of S3 Risk assessment policy "S3 buckets should not be publicly available".
Pinpoint Email /SES

"ses:List*"

"ses:Get*"

1. FortiCWP Resource List

2. SES profile

3. SES Risk assessment

CloudTrail

"cloudtrail:GetTrailStatus"

"cloudtrail:LookupEvents"

"cloudtrail:DescribeTrails"

"cloudtrail:ListTags"

"cloudtrail:GetEventSelectors"

1. FortiCWP Resource List

2. CloudTrail profile

3. CloudTrail Risk assessment

4. Feature "Activity" on FortiCWP

 

"cloudtrail:StartLogging"

"cloudtrail:UpdateTrail"

1. Allow autofix feature of CloudTrail Risk assessment policy "CloudTrail bucket should not be publicly accessible".
Elasticsearch Service

"es:List*"

"es:Describe*"

1. FortiCWP Resource List

2. ElasticSearch profile

3. ElasticSearch Risk assessment

Route 53

"route53:ListTrafficPolicyVersions"

"route53:GetHealthCheck"

"route53:ListHostedZonesByName"

"route53:GetHostedZoneCount"

"route53:GetHealthCheckLastFailureReason"

"route53:ListVPCAssociationAuthorizations"

"route53:GetReusableDelegationSetLimit"

"route53:ListTagsForResources"

"route53:GetAccountLimit"

"route53:GetGeoLocation"

"route53:GetTrafficPolicy"

"route53:ListQueryLoggingConfigs"

"route53:GetCheckerIpRanges"

"route53:ListGeoLocations"

"route53:GetTrafficPolicyInstance"

"route53:ListHostedZones"

"route53:ListTagsForResource"

"route53:ListHealthChecks"

"route53:GetHostedZone"

"route53:ListResourceRecordSets"

"route53:GetHealthCheckCount"

"route53:ListReusableDelegationSets"

"route53:ListTrafficPolicyInstancesByHostedZone"

"route53:GetHostedZoneLimit

"route53:ListTrafficPolicyInstances"

"route53:GetTrafficPolicyInstanceCount"

"route53:GetChange"

"route53:ListTrafficPolicies"

"route53:GetQueryLoggingConfig"

"route53:GetHealthCheckStatus"

"route53:GetReusableDelegationSet"

"route53:ListTrafficPolicyInstancesByPolicy"

1. FortiCWP Resource List

2. Route53 profile

3. Route53 Risk assessment

SNS

"sns:Get*"

"sns:*"

1. FortiCWP Resource List

2. SQS profile

3. SQS Risk assessment

"sns:*" 1. FortiCWP Notification’s integration with AWS SNS service
CloudWatch "cloudwatch:Describe*" 3. CloudWatch Risk assessment

FortiCWP Integration Permission

Service Policy in JSON Format Permission Purpose
SecurityHub "securityhub:*" 1. FortiCWP Integration Alerts for SecurityHub
Inspector "inspector:*" 1. FortiCWP Integration Alerts for Inspector
GuardDuty "guardduty:*" 1. FortiCWP Integration Alerts for GuardDuty

 

Appendix A - Workload Protection Amazon Policy Usage

Communication between AWS and FortiCWP requires granting FortiCWP with permissions to access AWS account resource configuration settings. The method is done through creating custom policy on AWS in JSON format in AWS  for .

Below are lists of the AWS services/policies used and the corresponding reasoning to be used in FortiCWP.

FortiCWP Basic Permission

Service Policy in JSON Format Permission Purpose
RDS

"rds:Describe*"

"rds:DownloadDBLogFilePortion"

"rds:ListTagsForResource"

1. FortiCWP Resource List

2. RDS profile

3. RDS Topology

4. RDS Risk assessment

"rds:ModifyDBInstance" 1. Allow autofix feature of RDS Risk assessment policy "RDS instances should not be publicly accessible".
EFS "elasticfilesystem:Describe*"

1. FortiCWP Resource List

2. EFS profile

3. EFS Risk assessment

ELB "elasticloadbalancing:Describe*"

1. FortiCWP Resource List

2. Listener, Load Balancer, Target Group profile

3. ELB Topology

4. ELB Risk assessment

"elasticloadbalancing:ModifyLoadBalancer Attributes" 1. Allow autofix feature of ELB Risk assessment policy "ELB/ALB deletion protection should be enabled".
Certificate Manager

"acm:List*"

"acm:Describe*"

1. FortiCWP Resource List

2. ACM Certificate profile

3. ACM Certificate Risk assessment

CloudFront

"cloudfront:List*"

"cloudfront:Get*"

1. FortiCWP Resource List

2. CloudFront profile

3. CloudFront Risk assessment

"cloudfront:UpdateDistribution" 1. Allow autofix feature of CloudFront Risk assessment policy "CloudFront should use secure ciphers for distribution".
EKS

"eks:ListUpdates"

"eks:DescribeUpdate"

"eks:DescribeCluster"

"eks:ListClusters"

1. FortiCWP Resource List

2. EKS profile

3. EKS Topology

KMS

"kms:List*"

"kms:Describe*"

"kms:Get*"

1. FortiCWP Resource List

2. KMS Key profile

3. KMS Risk assessment

  "kms:EnableKeyRotation" 1. Allow autofix feature of KMS Risk assessment policy "KMS key rotation should be enabled".
Lambda

"lambda:List*"

"lambda:GetPolicy"

1. FortiCWP Resource List

2. Lambda profile

3. Lambda Risk assessment

SQS

"sqs:ReceiveMessage"

"sqs:GetQueueUrl"

"sqs:GetQueueAttributes"

"sqs:ListQueueTags"

"sqs:ListQueues"

"sqs:ListDeadLetterSourceQueues"

1. FortiCWP Resource List

2. SQS profile

3. SQS Risk assessment

 

"sqs:TagQueue"

"sqs:UntagQueue"

"sqs:ChangeMessageVisibility

"sqs:ChangeMessageVisibilityBatch"

"sqs:CreateQueue"

"sqs:DeleteMessage"

"sqs:DeleteMessageBatch"

"sqs:DeleteQueue"

"sqs:PurgeQueue"

"sqs:SendMessage"

"sqs:SendMessageBatch"

"sqs:SetQueueAttributes"

1. FortiCWP Notification’s integration with AWS SQS service
IAM

"iam:List*"

"iam:SimulateCustomPolicy"

"iam:GenerateCredentialReport"

"iam:Get*"

"iam:SimulatePrincipalPolicy"

1. FortiCWP Resource List

2. IAM profile

3. IAM Risk assessment

"iam:UpdateAccountPasswordPolicy" 1. Allow autofix feature of Redshift Risk assessment policy "Password requirements should be enforced".
Redshift "redshift:Describe*"

1. FortiCWP Resource List

2. Redshift profile

3. Redshift Risk assessment

"redshift:Describe*"

"redshift:ModifyClusterParameterGroup"

1. Allow autofix feature of Redshift Risk assessment policy "Redshift database should use SSL for connections".
Elastic Container Service "ecs:Describe*" "ecs:List*"

1. FortiCWP Resource List

2. ECS profile

3. ECS Topology

EC2

"ec2:Describe*

"ec2:SearchTransitGatewayRoutes

"ec2:GetTransitGatewayAttachmentPropagations

"ec2:GetTransitGatewayRouteTablePropagations

"ec2:GetTransitGatewayRouteTableAssociations"

1. FortiCWP Resource List

2. VPC, Route Table, Subnet, Network ACL, Security Group, Machine Image(AMI), EC2, EBS volume, EBS snapshot profile

3. VPC, Subnet, Network ACL, Security Group, EC2 Topology

4. VPC, Subnet, Security Group, AMI, EC2, EBS Risk assessment

 

"ec2:ModifySnapshotAttribute"

"ec2:RevokeSecurityGroupEgress

"ec2:RevokeSecurityGroupIngress"

1. Allow autofix feature of EBS Risk assessment policy "EBS snapshots should not be publicly accessible".

2. Allow autofix feature of Security Group Risk assessment policy "Default Security Group should block all inbound traffic".

CloudWatch Logs

"logs:Get*"

"logs:Describe*"

"logs:FilterLogEvents"

1. Feature "Traffic" on FortiCWP
Glacier

"glacier:ListVaults"

"glacier:GetVaultAccessPolicy"

1. FortiCWP Resource List

2. Glacier profile

3. Glacier Risk assessment

CloudFormation

"cloudformation:ListStack*"

"cloudformation:GetTemplate"

"cloudformation:DescribeStack*"

1. FortiCWP Resource List

2. CloudFormation profile

3. CloudFormation Risk assessment

S3

"s3:GetBucket*"

"s3:GetReplicationConfiguration"

"s3:GetLifecycleConfiguration"

"s3:GetInventoryConfiguration"

"s3:ListBucket"

"s3:ListBucketMultipartUploads

"s3:GetAccountPublicAccessBlock"

"s3:ListAllMyBuckets"

"s3:GetObjectVersion"

"s3:GetObjectVersionTagging"

"s3:GetObjectAcl"

"s3:GetObjectVersionAcl"

"s3:HeadBucket"

"s3:ListMultipartUploadParts"

"s3:GetObject"

"s3:GetAnalyticsConfiguration

"s3:GetObjectVersionForReplication"

"s3:ListBucketByTags"

"s3:ListBucketVersions"

"s3:GetAccelerateConfiguration"

"s3:GetObjectVersionTorrent"

"s3:GetEncryptionConfiguration"

"s3:GetObjectTagging"

"s3:GetMetricsConfiguration"

"s3:GetObjectTorrent"

1. FortiCWP Resource List

2. S3 bucket profile

3. S3 Risk assessment

4. Feature "Buckets" on FortiCWP

"s3:PutBucketVersioning"

"s3:PutBucketAcl"

"s3:PutBucketPolicy"

"s3:PutObjectAcl"

"s3:PutObjectVersionAcl"

1. Allow autofix feature of S3 Risk assessment policy "S3 buckets should not be publicly available".
Pinpoint Email /SES

"ses:List*"

"ses:Get*"

1. FortiCWP Resource List

2. SES profile

3. SES Risk assessment

CloudTrail

"cloudtrail:GetTrailStatus"

"cloudtrail:LookupEvents"

"cloudtrail:DescribeTrails"

"cloudtrail:ListTags"

"cloudtrail:GetEventSelectors"

1. FortiCWP Resource List

2. CloudTrail profile

3. CloudTrail Risk assessment

4. Feature "Activity" on FortiCWP

 

"cloudtrail:StartLogging"

"cloudtrail:UpdateTrail"

1. Allow autofix feature of CloudTrail Risk assessment policy "CloudTrail bucket should not be publicly accessible".
Elasticsearch Service

"es:List*"

"es:Describe*"

1. FortiCWP Resource List

2. ElasticSearch profile

3. ElasticSearch Risk assessment

Route 53

"route53:ListTrafficPolicyVersions"

"route53:GetHealthCheck"

"route53:ListHostedZonesByName"

"route53:GetHostedZoneCount"

"route53:GetHealthCheckLastFailureReason"

"route53:ListVPCAssociationAuthorizations"

"route53:GetReusableDelegationSetLimit"

"route53:ListTagsForResources"

"route53:GetAccountLimit"

"route53:GetGeoLocation"

"route53:GetTrafficPolicy"

"route53:ListQueryLoggingConfigs"

"route53:GetCheckerIpRanges"

"route53:ListGeoLocations"

"route53:GetTrafficPolicyInstance"

"route53:ListHostedZones"

"route53:ListTagsForResource"

"route53:ListHealthChecks"

"route53:GetHostedZone"

"route53:ListResourceRecordSets"

"route53:GetHealthCheckCount"

"route53:ListReusableDelegationSets"

"route53:ListTrafficPolicyInstancesByHostedZone"

"route53:GetHostedZoneLimit

"route53:ListTrafficPolicyInstances"

"route53:GetTrafficPolicyInstanceCount"

"route53:GetChange"

"route53:ListTrafficPolicies"

"route53:GetQueryLoggingConfig"

"route53:GetHealthCheckStatus"

"route53:GetReusableDelegationSet"

"route53:ListTrafficPolicyInstancesByPolicy"

1. FortiCWP Resource List

2. Route53 profile

3. Route53 Risk assessment

SNS

"sns:Get*"

"sns:*"

1. FortiCWP Resource List

2. SQS profile

3. SQS Risk assessment

"sns:*" 1. FortiCWP Notification’s integration with AWS SNS service
CloudWatch "cloudwatch:Describe*" 3. CloudWatch Risk assessment

FortiCWP Integration Permission

Service Policy in JSON Format Permission Purpose
SecurityHub "securityhub:*" 1. FortiCWP Integration Alerts for SecurityHub
Inspector "inspector:*" 1. FortiCWP Integration Alerts for Inspector
GuardDuty "guardduty:*" 1. FortiCWP Integration Alerts for GuardDuty