Creating The AWS credentials

In this guide we will create the needed AWS Credentials for IDSTower to export Rules & IOCs to your AWS Network Firewall.

Creating the Credentials Access Policy

1. Login to your AWS IAM Console.

2. Under Access Management, click on “Policies”.

3. Then, click on “Create Policy”.

4. After that, click on the JSON tap and paste and the replace what is in the text box with the below policy definition.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "network-firewall:DescribeRuleGroup",
                "network-firewall:DeleteRuleGroup",
                "network-firewall:CreateRuleGroup",
                "network-firewall:TagResource",
                "network-firewall:DescribeRuleGroupMetadata",
                "network-firewall:UpdateRuleGroup",
                "network-firewall:UntagResource"
            ],
            "Resource": [
                "arn:aws:network-firewall:*:*:stateful-rulegroup/IDSTower-*",
                "arn:aws:network-firewall:*:*:stateless-rulegroup/IDSTower-*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "network-firewall:ListRuleGroups",
            "Resource": "*"
        }
    ]
}

Note

The above policy will limit the credentials access to only the resources under the aws network firewall rule groups that starts with the “IDSTower_” prefix, all resources created by the AWS Connector will have this prefix.

5. Click on “Next: Tags”, and add any tags you need to add (optional).

6. Click on “Next: Review”, and add a name (eg: IDSTower) & description (optional) to the policy.

7. Click on “Create policy”.

8. The Policy should have been created successfully by now.

Creating the Credentials

Now that we have created the needed IAM policy, we will proceed to create the credentials.

1. Under Access Management, click on “Users”.

2. Click on “Add users”

3. Choose a username, eg: idstower_aws_export, and under “Select AWS access type” check “Access key - Programmatic access”.

4. Click on “Next: Permissions”

5. Click on “Attach existing policies directly”

6. Search for the IDSTower Policy that we created previously, and click the check beside it.

7. Click on “Next: Tags”, and add any tags you want (optional).

8. Click on “Next: Review”, and review the details.

9. Click on “Create user”.

10. The user should have been created successfully by now, copy the username, Access Key ID & The Secret access key to a save place as we will need them in the next steps.

In the previous steps, we have created the credentials needed for IDSTower to access the AWS Network Firewall and publish the IDS Rules, we also created a policy for that user that describe the access rights and permissions for the exports to work correctly.

Next, we will add those credentials to IDSTower and proceed to create our export.