Initial Setup of AWS GovCloud Integration

AWS GovCloud (US-East and US-West) are isolated regions within AWS for customers to host sensitive data for supporting their regulated workflows. The configuration workflow described below differs from AWS standard regions and is only relevant for monitoring AWS GovCloud environments within Lacework application.

The initial setup of creating an Integration between Lacework and an AWS GovCloud requires running steps in the AWS GovCloud console followed by running a second set of steps in the Lacework Console, as described below.

The steps below configure either an AWS CloudTrail (US GovCloud) or an AWS Config (US GovCloud) integration.

• Configure an AWS CloudTrail (US GovCloud) integration to analyze CloudTrail activity for monitoring cloud account security.
• Configure an AWS Config (US GovCloud) integration to analyze AWS configuration compliance.

If you want to analyze AWS configuration compliance and account security (CloudTrail), you must configure both an AWS CloudTrail (US GovCloud) and an AWS Config (US GovCloud) integrations.

Create the Lacework AWS GovCloud CloudFormation Template  

You must create an AWS GovCloud CloudFormation template file that creates a new AWS GovCloud CloudFormation stack.

To download and customize the template file:

1. Open a text editor.
2. Click the following link:
   https://raw.githubusercontent.com/lacework/csp-integrations/master/aws-govcloud-template/lacework-aws-gov-cloud-ct-cfg.json
   The Lacework AWS GovCloud CloudFormation template file displays in GitHub.
3. Select all the text in the GitHub window of the browser. (In Chrome, select Edit > Select All.)
4. Copy the text. (In Chrome, select Edit > Copy.)
5. Paste the text into the text editor.
6. In the text editor, replace the %acnt string with the name of your AWS account.
   

   "Parameters": {
       "ResourceNamePrefix": {
         ...
         "Default": "%acnt",
         ...
    },

7. Save the file as lacework-aws-gov-cloud-ct-cfg.json in the text editor.

Create a Stack in Cloudformation Using the Customized CloudFormation template

To create a new stack in the AWS GovCloud:

1. Log in to an AWS account on the AWS GovCloud with administrative credentials. The AWS account used to create the stack must use a role with the aws:policy/SecurityAudit permission.
2. Select the CloudFormation service.
   
   In the AWS console, select Services > Management Tools > CloudFormation.
   The Create Stack panel displays.
3. From the Region drop-down located in the top left of the menu bar, select the appropriate region for your environment.
   
4. Click Create Stack.
   The Select Template panel displays.
5. Under Choose a template, select Upload a template to Amazon S3. Browse for the Lacework AWS GovCloud template file that you previously created and click Open.
6. Click Next.
   The Specify Details page displays.
7. In the Stack name field, enter a unique value.
8. On the Create stack > Specify Details page, you can either create a new trail and S3 bucket or use an existing trail. Follow the appropriate procedure for your AWS GovCloud environment:
   • Option#1 - Create a New Trail and S3 Bucket
   • Option#2 - Use an Existing Trail

Option#1 - Create a New Trail and S3 Bucket

If you plan to separately integrate multiple accounts, the Resource Name Prefix must be different for each account because S3 bucket names are globally unique.

1. Resource name prefix should be pre-populated with your account name. The value does not need to change unless:
• you are creating a stack for each account—For this case, the value must be unique for each account because the S3 bucket namespace is global.
• you are creating multiple stacks—For this case, the value must be unique to avoid a resource collision.
2. Set Create a new trail? to Yes.
3. If you want a specific S3 bucket path for your logs, add a Log file prefix.
4. Leave the values for Bucket name and Topic ARN blank.
5. Click Next.
   
   

Option#2 - Use an Existing Trail

1. Resource name prefix should be pre-populated with your account name.
2. Set Create a new trail? to No.
3. The Log file prefix is not applicable because you are not creating a new trail.
4. Enter the Bucket name associated with your existing trail.
5. Add the SNS Topic ARN of your existing trail into Topic ARN. If the trail does not already have an SNS topic, you must create one.
6. Click Next. 
   

Continue Stack Creation and Gather Settings

Complete the creation of the stack in the AWS console and gather the required settings as described by the following steps.

1. In the Create stack > Options page, no changes are required. Click Next.
2. In the Create Stack > Review page, select the acknowledgment and click Create.  
   After clicking Create, you are redirected back to the CloudFormation page.
3. If you do not see your new stack in the table, refresh the page. Keep refreshing the page until the status of the stack is CREATE-COMPLETE.
4. After the stack status is CREATE-COMPLETE, click the stack name link.
5. Expand Outputs.
6. Leave the AWS console open to this page so you can copy the following values about the stack.
   • AccountId
   • AccessKeyId
   • SecretAccessKey
   • SQSQueueURL
     

You need these values when you finish creating the Integration using the Lacework Console as described in the next procedure.

Finish Integration using the Lacework Console

Finish the integration using the Lacework Console as described by the following steps.

1. Log in to the Lacework Console.
2. Select Settings > Integrations.  
3. Select one of the following options:
• Select INCOMING > AWS CloudTrail (US GovCloud) to analyze CloudTrail activity for monitoring cloud account security.
• Select INCOMING > AWS Config (US GovCloud) to analyze AWS configuration compliance. 
4. Click + ADD INTEGRATION.
5. In the Name field, enter a unique name for the integration.
6. In the Account ID field, enter the AccountId value copied from the AWS console.
7. In the Access Key ID field, enter the AccessKeyId value copied from the AWS console.
8. In the Secret Access Key field, enter the SecretAccessKey value copied from the AWS console.
9. If you are configuring an AWS CloudTrail (US GovCloud) integration, in the SQS Queue URL field enter the SQSQueueURL value copied from the AWS console. (This step is not required for an AWS Config (US GovCloud) integration.
10. Click Save. In Settings > INCOMING, a new integration displays.
11. When the integration is complete and successful, the status changes to Integration Successful.  

To analyze CloudTrail activity for monitoring cloud account security and analyze AWS configuration compliance, you must create both AWS CloudTrail (US GovCloud) and AWS Config (US GovCloud) integrations.

If you want to create a second integration, repeat the Finish Integration using the Lacework Console procedure. You can reuse the same set of stack values for the second integration.