Amazon Web Services (AWS)

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Amazon Web Services (AWS) using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules. Compliance checks re-run once a day at 02:00 America/New_York.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Amazon Web Services (AWS) environment.

What DSALTA reads

DSALTA reads the Amazon Web Services (AWS) IAM user list — user names, IAM paths and creation dates, which appears on your Access page; and your AWS resources, which appear on your Inventory page; and open security findings, which appear on your Vulnerabilities page. IAM records no email address or account status, so the Email column repeats the IAM user name, the Role column shows the IAM path (“User” for the default path), and every user is listed as Active.DSALTA reads AWS through the official AWS SDK for JavaScript (the @aws-sdk/client-* packages), so the permissions are IAM actions rather than URL paths.Permissions the checks require: the AWS-managed SecurityAudit policy, which the setup path on this page attaches to the role. That policy is what grants DSALTA’s read access, together with sts:AssumeRole to enter the role itself.

Which AWS services DSALTA reads

Access Analyzer · ACM · CloudTrail · CloudWatch · AWS Config · DocumentDB · DynamoDB · EC2 (including EBS and VPC) · ECR · ECS · EFS · EKS · Elastic Load Balancing v2 · GuardDuty · IAM · KMS · Lambda · RDS · Redshift · S3 · Security Hub · SNS · STSEvery call is a Describe*, Get* or List* read.

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Amazon Web Services (AWS) environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Amazon Web Services (AWS) card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Amazon Web Services (AWS). DSALTA assumes your audit role with the external ID on every run, so check that the CloudFormation stack and the DSALTAAuditRole still exist, that the trust policy still trusts DSALTA’s account ID (801490935739) and your external ID, and that the SecurityAudit policy is still attached.

Data is not syncing

Verify the connected account still holds the permissions listed under Before you begin. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Amazon Web Services offers 2 ways to connect. Use CloudFormation Template is recommended.

Use CloudFormation Template (recommended)
Create IAM role manually

Automate the creation of an IAM role in your AWS account with specific access permissions using a CloudFormation template.Before you begin

AdministratorAccess policy attached to your user, role, or group (or equivalent), and permissions to create IAM roles and CloudFormation stacks

You will need:

Field	Where to find it	Example
Role ARN	See the steps below	`arn:aws:iam::123456789012:role/DSALTAAuditRole`
Regions	See the steps below	—

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Amazon Web Services, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating AWS with DSALTA means

DSALTA will only be able to “read” your resources to monitor and record statuses for security compliance.DSALTA allows you to mark specific resources to be monitored and ignore others.DSALTA will remind you as and when any of the resources require attention.

Ensure you have attached the AdministratorAccess AWS policy to your user, role, or group before proceeding with the integration.

Copy and run bash code

Copy the bash command and run it in AWS CloudShell for the account you want DSALTA to audit. It creates the DSALTAAuditRole via CloudFormation with read-only audit permissions.

aws cloudformation create-stack \
  --stack-name DSALTA-Audit-Role \
  --template-url https://dsalta-public-assets.s3.us-east-1.amazonaws.com/cloudformation/dsalta-aws-audit-role-complete.yaml \
  --parameters \
    ParameterKey=DSALTAAccountId,ParameterValue=801490935739 \
    ParameterKey=ExternalId,ParameterValue=PASTE-EXTERNAL-ID-FROM-DSALTA \
    ParameterKey=EnableCloudTrail,ParameterValue=true \
    ParameterKey=EnableConfig,ParameterValue=true \
    ParameterKey=EnableSecurityHub,ParameterValue=true \
    ParameterKey=EnableAccessAnalyzer,ParameterValue=true \
  --capabilities CAPABILITY_NAMED_IAM \
  --region us-east-1

DSALTA requires certain permissions to complete the integration. You can choose to manage policy permissions.

The ExternalId in this command is fixed for this DSALTA organization (DSALTA- + org id). After disconnect or when another teammate connects, use the script from this wizard again — do not mix in another organization’s ExternalId or an old stack will keep the wrong trust until you update IAM or delete the stack.

Get Role ARN

After the stack is created, retrieve the Role ARN. Wait a few seconds before running the command; if the stack is still CREATE_IN_PROGRESS, wait and retry.

aws cloudformation describe-stacks \
  --stack-name DSALTA-Audit-Role \
  --query 'Stacks[0].Outputs[?OutputKey==`RoleArn`].OutputValue' \
  --output text \
  --region us-east-1

If the output shows CREATE_IN_PROGRESS, wait a few seconds and run the command again until the Role ARN is returned.

The Regions field is a fixed list of 18 regions: us-east-1/2, us-west-1/2, eu-west-1/2/3, eu-central-1, eu-north-1, ap-southeast-1/2, ap-northeast-1/2, ap-south-1, sa-east-1, ca-central-1, me-south-1 and af-south-1. Anything outside that list — including GovCloud and China partitions — cannot be selected and will not be scanned. You can change the selection later, so start with the regions that hold production workloads.

Complete Integration

Enter the Role ARN from the previous step and select the AWS regions where your production workloads run.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Failed to connect. Please verify the Role ARN and try again.The on-screen message is generic — see Connection error messages.

Configure the role manually with the appropriate policies and permissions to ensure that DSALTA can access your cloud resources.Before you begin

AdministratorAccess policy attached to your user, role, or group (or equivalent), and permissions to create IAM roles and policies

You will need:

Field	Where to find it	Example
Role ARN	See the steps below	`arn:aws:iam::123456789012:role/DSALTAAuditRole`
Regions	See the steps below	—

Start in DSALTA

Integrating AWS with DSALTA means

DSALTA connects to your AWS account via an IAM role. This role must have specific access to audit all the resources in your AWS account.

Ensure you have attached the AdministratorAccess AWS policy to your user, role, or group before proceeding.

Setup roles

Log in to your AWS account console and go to IAM.Navigate to the Roles section and click on Create role. Choose Another AWS account on the resulting page.

Setup permissions

In the “Specify accounts that can use this role” section, enter the following:Account ID: 801490935739External ID: the value shown in the DSALTA connect panelEnsure Require external ID is checked. Do not check the setting for MFA. Click on Next.On the Add permissions screen, search for SecurityAudit and select it. Click on Next.

Additional permissions (Optional)

Do not attach CloudWatchFullAccess — it grants write access. DSALTA only reads CloudWatch alarms (cloudwatch:DescribeAlarms and cloudwatch:DescribeAlarmsForMetric), which SecurityAudit already permits.DSALTA does not read AWS IAM Identity Center (SSO) users — the Access page is built from IAM users only — so there is no need to attach any SSO policy.You can add tags in the Add Tags section if desired. This is optional.

Complete role setup

In the Role details section, enter the Role name: DSALTAAuditRole (recommended — matches the CloudFormation template) or any name you prefer, then click Create role.Search for the role you created and copy its Role ARN exactly as shown in IAM.

Copy the ARN exactly as IAM shows it — DSALTA validates it against arn:aws:iam::<12-digit account>:role/<name>. A leading/trailing space, a path segment, or a GovCloud (arn:aws-us-gov:) or China (arn:aws-cn:) ARN is rejected with “Invalid IAM Role ARN format” before any AWS call is made.

Complete Integration

Enter the Role ARN of the role you created and select the AWS regions where your production workloads run.

If the connection is rejected. Failed to connect. Please verify the role configuration and try again.The on-screen message is generic — see Connection error messages.

Each check below re-runs once a day, at 02:00 America/New_York, while this integration is connected. Click any check for step-by-step remediation guidance.

Check	Severity	What it verifies
AWS user should have MFA enabled	Critical	Checks that all IAM users with console access have MFA enabled.
AWS root account should have MFA enabled	Critical	Checks that the root account has MFA enabled.
AWS root account usage should be avoided	High	Checks that the root account is not being used for day-to-day operations.
AWS account password policy should be configured	Medium	Verifies a strong password policy is set on the AWS account.
AWS user access keys should not be older than 90 days	High	Checks that IAM user access keys are rotated within 90 days.
AWS credentials not used in last 90 days should be disabled	Medium	Checks that credentials unused for 90 days are disabled.
AWS users should not have attached IAM policies	Medium	Checks that IAM users receive permissions only through groups.
AWS groups should have at least one IAM policy	Low	Checks that IAM groups have at least one policy attached.
AWS should be on https	High	Checks that services enforce HTTPS for data in transit.
AWS should redirect http to https	High	Checks that HTTP traffic is redirected to HTTPS.
AWS server access logs should be retained for 90 days	Medium	Checks that CloudTrail and S3 access logs are retained for at least 90 days.
Infra entity should be classified	Low	Checks that AWS resources are tagged with classification labels.
AWS access should be removed for offboarded user	High	Checks that offboarded users no longer have active IAM access to AWS resources.
AWS CloudTrail should be enabled	High	Checks that CloudTrail is enabled and actively logging.
AWS GuardDuty should be enabled	High	Checks that Amazon GuardDuty is enabled for threat detection.
Reported incident should be closed in Guard duty	Medium	Checks that GuardDuty findings are being addressed and archived.
AWS CloudTrail log file integrity validation should be enabled	High	Ensures log file validation is enabled to detect tampering.
AWS Cloud Trail S3 logging bucket access logging should be enabled	Medium	Checks that the S3 bucket storing CloudTrail logs has access logging enabled.
AWS S3 storage bucket should be encrypted	High	Checks that S3 buckets have server-side encryption enabled.
AWS S3 bucket public access should be blocked	Critical	Checks that S3 buckets have public access blocked.
AWS S3 bucket should be versioned	Medium	Checks that S3 buckets have versioning enabled.
AWS S3 server access logging should be enabled for important buckets	Medium	Checks that S3 buckets have server access logging enabled.
AWS Cloud Trail logging bucket should be protected from direct internet traffic	High	Checks that the CloudTrail S3 bucket is not publicly accessible.
AWS EC2 instance should be protected from direct internet traffic	High	Checks that EC2 instances are not directly exposed to the internet.
AWS EC2 instance CPU utilization should be monitored	Medium	Checks that CloudWatch alarms are configured for EC2 CPU utilization.
AWS EBS volume backup should be enabled	High	Checks that EBS volumes have snapshots or backup policies.
AWS EBS volume should be encrypted	High	Checks that EBS volumes have encryption enabled.
AWS EBS health should be monitored	Medium	Checks that EBS volume health is monitored via CloudWatch.
AWS RDS database freespace should be monitored	Medium	Checks that CloudWatch alarms monitor RDS free storage space.
AWS RDS database CPU utilization should be monitored	Medium	Checks that CloudWatch alarms monitor RDS CPU utilization.
AWS RDS Database freeable memory should be monitored	Medium	Checks that CloudWatch alarms monitor RDS freeable memory.
AWS RDS database IO utilization should be monitored	Medium	Checks that CloudWatch alarms monitor RDS IO operations.
AWS RDS database backup should be enabled	High	Checks that RDS instances have automated backups enabled.
AWS RDS database storage should be encrypted	High	Checks that RDS instances have storage encryption enabled.
AWS RDS database should be protected from direct internet traffic	Critical	Checks that RDS instances are not publicly accessible.
AWS EFS storage backup should be enabled	High	Checks that EFS file systems have backup enabled.
AWS EFS storage should be encrypted	High	Checks that EFS file systems have encryption at rest enabled.
AWS FSX File System storage backup should be enabled	High	Checks that FSx file systems have automatic backups enabled.
AWS FSX File System storage should be encrypted	High	Checks that FSx file systems have encryption enabled.
AWS FSX File System freespace should be monitored	Medium	Checks that FSx free space is monitored via CloudWatch.
AWS VPC flowlogs should be captured	High	Checks that VPC Flow Logs are enabled for all VPCs.
AWS DynamoDB latency should be monitored	Medium	Checks that DynamoDB table latency is monitored via CloudWatch.
AWS DynamoDB point in time recovery should be enabled	High	Checks that DynamoDB tables have point-in-time recovery enabled.
AWS DynamoDB should be encrypted	High	Checks that DynamoDB tables have encryption enabled.
AWS DynamoDB read capacity should be monitored	Medium	Checks that DynamoDB read capacity is monitored.
AWS DynamoDB write capacity should be monitored	Medium	Checks that DynamoDB write capacity is monitored.
AWS DynamoDB backup should be enabled	High	Checks that DynamoDB tables have on-demand or scheduled backups.
AWS ECS CPU utilization should be monitored	Medium	Checks that ECS service CPU utilization is monitored.
AWS ECS memory utilization should be monitored	Medium	Checks that ECS service memory utilization is monitored.
AWS ECR repository should be encrypted	High	Checks that ECR repositories have encryption enabled.
AWS load balancer errors should be monitored	Medium	Checks that ALB 5xx errors are monitored via CloudWatch.
AWS load balancer latency should be monitored	Medium	Checks that ALB latency is monitored via CloudWatch.
AWS classic load balancer errors should be monitored	Medium	Checks that CLB errors are monitored via CloudWatch.
AWS classic load balancer latency should be monitored	Medium	Checks that CLB latency is monitored via CloudWatch.
AWS load balancer should redirect traffic from http to https	High	Checks that ALBs redirect HTTP to HTTPS.
AWS load balancer healthy host count should be monitored	Medium	Checks that healthy host count is monitored on ALBs.
AWS load balancer should have valid configuration	Medium	Checks that load balancers have valid listener and target group configurations.
AWS load balancer host health should be monitored	Medium	Checks that unhealthy host count is monitored on load balancers.
AWS application load balancer should be protected from direct internet traffic	High	Checks that internal ALBs are not exposed to the internet.
AWS ElastiCache datastore CPU utilization should be monitored	Medium	Checks that ElastiCache CPU utilization is monitored.
AWS ElastiCache current connections should be monitored	Medium	Checks that ElastiCache connection count is monitored.
AWS ElastiCache freeable memory should be monitored	Medium	Checks that ElastiCache freeable memory is monitored.
AWS Redshift cluster backup should be enabled	High	Checks that Redshift clusters have automated snapshots enabled.
AWS Redshift cluster should be encrypted	High	Checks that Redshift clusters have encryption enabled.
AWS Redshift CPU utilization should be monitored	Medium	Checks that Redshift CPU utilization is monitored.
AWS Redshift health should be monitored	Medium	Checks that Redshift cluster health is monitored.
AWS SQS messages visibility should be monitored	Medium	Checks that SQS visible messages are monitored.
AWS SQS messages age should be monitored	Medium	Checks that SQS message age is monitored.
AWS Firehose stream throttling should be monitored	Medium	Checks that Firehose delivery stream throttling is monitored.
AWS API gateway V2 errors should be monitored	Medium	Checks that API Gateway V2 errors are monitored.
AWS Elasticsearch cluster freespace should be monitored	Medium	Checks that Elasticsearch free storage space is monitored.
AWS Elasticsearch cluster CPU utilization should be monitored	Medium	Checks that Elasticsearch CPU utilization is monitored.
AWS Elasticsearch cluster health should be monitored	Medium	Checks that Elasticsearch cluster health is monitored.
AWS Lightsail instance CPU utilization should be monitored	Medium	Checks that Lightsail instance CPU is monitored.
AWS Lightsail disk backup should be enabled	High	Checks that Lightsail disks have automatic snapshots enabled.
AWS Lightsail disk should be encrypted	High	Checks that Lightsail disks are encrypted.

Topic	Link
Setup	AWS CloudFormation Documentation
Setup	AWS IAM Roles Documentation
Setup	Creating IAM Roles
General	Amazon Web Services website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting