Skip to main content

AWS

Cloud Security and Compliance provides support for the following use cases and Lacework features:

Use CasesLacework Feature(s)Data Source
Cloud Security Posture Management (CSPM)
Cloud Infrastructure Entitilement Management (CIEM)		Compliance Dashboard and Reports
Cloud Infrastructure Entitilement Management Dashboard
Attack Path Analysis and Exposure Polygraph		AWS Cloud Configuration
User Entity Behaviour Analytics (UEBA)Cloud Anomaly Detection
Cloud Drift Detection
Cloud Audit Polygraph		AWS Cloud Audit Logs
Vulnerability ManagementVulnerability Management DashboardECR
Agentless Workload Scanning
User Entity Behaviour Analytics (UEBA)Kubernetes Audit Log Dashboard
Kubernetes Anomaly Detection
Kubernetes Audit Log Polygraph		EKS Audit

See below for information on planning Lacework integrations and the specific use cases for each integration:

Use CasesLacework Feature(s)Data Source
Cloud Security Posture Management (CSPM)
Cloud Infrastructure Entitilement Management (CIEM)		Compliance Dashboard and Reports
Cloud Infrastructure Entitilement Management Dashboard
Attack Path Analysis and Exposure Polygraph		AWS Cloud Configuration
User Entity Behaviour Analytics (UEBA)Cloud Anomaly Detection
Cloud Drift Detection
Cloud Audit Polygraph		Cloud Audit Logs

Standard Cloud Account Integration

Prerequisites 📎

Prerequisites

Before you can integrate your AWS cloud environment with Lacework, you must configure the following:

  • SNS topic - An Amazon Simple Notification Service (SNS) topic is a logical access point that acts as a communication channel. A topic lets you group multiple endpoints, such as AWS, Amazon SQS, HTTP/S, or an email address. All CloudTrail integrations require an SNS topic. Lacework can use an existing SNS topic or create one if you have not added an SNS topic to an existing CloudTrail.
  • SQS queue - Amazon Simple Queue Service (SQS) is a message queue service used by distributed applications to exchange messages through a polling model. SQS decouples sending and receiving components without requiring each component to be concurrently available. Used together, Amazon SNS and Amazon SQS can deliver messages to applications that require immediate notification of an event. Messages are also persisted in an Amazon SQS queue for other applications to process at a later time. All CloudTrail integrations require an SQS queue.
  • S3 bucket - A bucket is a container for objects stored in Amazon S3. All CloudTrail integrations require an S3 bucket. Lacework can use an existing bucket or create one in the designated account.
  • CloudTrail - AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Lacework can use an existing CloudTrail or create a new trail.
  • IAM cross-account role - A cross-account role is required to give Lacework access for assessments of cloud resource configurations and for analysis of CloudTrail events. The cross-account role is given the following policies:
    • Lacework custom audit policy - A custom policy that enables read-only access to configuration resources.
    • Lacework custom IAM policy - A custom policy that provides Lacework read-only access to ingest CloudTrail logs.
note

Ensure that your IAM cross-account role and S3 bucket are collocated in the same AWS account - whether you're trying to configure this manually, via CloudFormation, or Terraform. This is related to legacy AWS rules that govern access to objects created inside S3 buckets that are beyond Lacework’s control. Setting up cross-account access is not enough to work around this issue.

Architecture 📎
The diagram below outlines the standard cloud audit event delivery architecture, using Cloudtrail SNS notifications.Lacework AWS Architecture
Architecture (S3 Bucket Notification) 📎
The diagram below outlines an alternative cloud audit event delivery architecture, using S3 bucket notifications.Lacework AWS Architecture (S3 Notification)
Permissions Required for Deployment 📎

Cloud Audit and Cloud Configuration

The permissions outlined here are required when using the default terraform configuration and applicable to the target account for integration:
View JSON 📎
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:CreateTrail",
                "cloudtrail:DeleteTrail",
                "cloudtrail:DescribeTrails",
                "cloudtrail:GetEventSelectors",
                "cloudtrail:GetTrailStatus",
                "cloudtrail:ListTags",
                "cloudtrail:StartLogging",
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:DeletePolicy",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:TagRole",
                "kms:CancelKeyDeletion",
                "kms:Create*",
                "kms:CreateKey",
                "kms:Delete*",
                "kms:Describe*",
                "kms:DescribeKey",
                "kms:Disable*",
                "kms:Enable*",
                "kms:Get*",
                "kms:GetKeyPolicy",
                "kms:GetKeyRotationStatus",
                "kms:List*",
                "kms:ListResourceTags",
                "kms:Put*",
                "kms:Revoke*",
                "kms:ScheduleKeyDeletion",
                "kms:TagResource",
                "kms:Update*",
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:DeleteBucket*",
                "s3:DeleteBucketPolicy",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:Get*",
                "s3:GetAccelerateConfiguration",
                "s3:GetBucketAcl",
                "s3:GetBucketCORS",
                "s3:GetBucketLogging",
                "s3:GetBucketObjectLockConfiguration",
                "s3:GetBucketOwnershipControls",
                "s3:GetBucketPolicy",
                "s3:GetBucketPublicAccessBlock",
                "s3:GetBucketRequestPayment",
                "s3:GetBucketTagging",
                "s3:GetBucketVersioning",
                "s3:GetBucketWebsite",
                "s3:GetEncryptionConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:List*",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:PutBucketAcl",
                "s3:PutBucketLogging",
                "s3:PutBucketNotification",
                "s3:PutBucketOwnershipControls",
                "s3:PutBucketPolicy",
                "s3:PutBucketPublicAccessBlock",
                "s3:PutBucketVersioning",
                "s3:PutEncryptionConfiguration",
                "sns:CreateTopic",
                "sns:DeleteTopic",
                "sns:GetSubscriptionAttributes",
                "sns:GetTopicAttributes",
                "sns:ListTagsForResource",
                "sns:SetTopicAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteQueue",
                "sqs:GetQueueAttributes",
                "sqs:ListQueueTags",
                "sqs:SetQueueAttributes"
            ],
            "Resource": "*"
        }
    ]
}
ScopePermission
<AWS_ACCOUNT_ID>cloudtrail:CreateTrail
<AWS_ACCOUNT_ID>cloudtrail:DeleteTrail
<AWS_ACCOUNT_ID>cloudtrail:DescribeTrails
<AWS_ACCOUNT_ID>cloudtrail:GetEventSelectors
<AWS_ACCOUNT_ID>cloudtrail:GetTrailStatus
<AWS_ACCOUNT_ID>cloudtrail:ListTags
<AWS_ACCOUNT_ID>cloudtrail:StartLogging
Permissions Used in Operation 📎
The list of the various least-privilege roles deployed as part of Cloud Security and Compliance via Terraform or Cloudformation:

View JSON 📎
[
    {
        "Type":"aws_iam_role",
        "Name":"role\/lacework-ct-iam-<UNIQUE_ID>",
        "Account":"<AWS_ACCOUNT_ID>",
        "Trust Relationships":{
            "Statement":[
                {
                    "Action":"sts:AssumeRole",
                    "Condition":{
                        "StringEquals":{
                            "sts:ExternalId":"<EXTERNAL_ID>"
                        }
                    },
                    "Effect":"Allow",
                    "Principal":{
                        "AWS":"arn:aws:iam::434813966438:root"
                    },
                    "Sid":""
                }
            ],
            "Version":"2012-10-17"
        },
        "Permissions":[
            {
                "name":"lacework-ct-cross-acct-policy-<UNIQUE_ID>",
                "policy":{
                    "Statement":[
                        {
                            "Action":"s3:Get*",
                            "Effect":"Allow",
                            "Resource":"arn:aws:s3:::lacework-ct-bucket-<UNIQUE_ID>\/*",
                            "Sid":"ReadLogFiles"
                        },
                        {
                            "Action":"kms:Decrypt",
                            "Effect":"Allow",
                            "Resource":"arn:aws:kms:us-east-1:<AWS_ACCOUNT_ID>:key\/<KMS_KEY_ID>",
                            "Sid":"DecryptLogFiles"
                        },
                        {
                            "Action":"kms:Decrypt",
                            "Effect":"Allow",
                            "Resource":"arn:aws:kms:us-east-1:<AWS_ACCOUNT_ID>:key\/<KMS_KEY_ID>",
                            "Sid":"DecryptQueueFiles"
                        },
                        {
                            "Action":"iam:ListAccountAliases",
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"GetAccountAlias"
                        },
                        {
                            "Action":"s3:ListBucket",
                            "Condition":{
                                "StringLike":{
                                    "s3:prefix":"*AWSLogs\/"
                                }
                            },
                            "Effect":"Allow",
                            "Resource":"arn:aws:s3:::lacework-ct-bucket-<UNIQUE_ID>",
                            "Sid":"ListLogFiles"
                        },
                        {
                            "Action":[
                                "sqs:ReceiveMessage",
                                "sqs:GetQueueUrl",
                                "sqs:GetQueueAttributes",
                                "sqs:DeleteMessage"
                            ],
                            "Effect":"Allow",
                            "Resource":"arn:aws:sqs:us-east-1:<AWS_ACCOUNT_ID>:lacework-ct-sqs-<UNIQUE_ID>",
                            "Sid":"ConsumeNotifications"
                        },
                        {
                            "Action":[
                                "sns:ListTopics",
                                "sns:ListSubscriptions",
                                "sns:GetTopicAttributes",
                                "s3:GetBucketPolicy",
                                "s3:GetBucketLocation",
                                "cloudtrail:GetTrailStatus",
                                "cloudtrail:DescribeTrails"
                            ],
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"Debug"
                        }
                    ],
                    "Version":"2012-10-17"
                }
            }
        ]
    },
    {
        "Type":"aws_iam_role",
        "Name":"role\/lw-iam-<UNIQUE_ID>",
        "Account":"<AWS_ACCOUNT_ID>",
        "Trust Relationships":{
            "Statement":[
                {
                    "Action":"sts:AssumeRole",
                    "Condition":{
                        "StringEquals":{
                            "sts:ExternalId":"lweid:aws:v2:<ACCOUNT>:<AWS_ACCOUNT_ID>:<UNIQUE_ID>"
                        }
                    },
                    "Effect":"Allow",
                    "Principal":{
                        "AWS":"arn:aws:iam::434813966438:root"
                    },
                    "Sid":""
                }
            ],
            "Version":"2012-10-17"
        },
        "Permissions":[
            {
                "name":"lwaudit-policy-<UNIQUE_ID>",
                "policy":{
                    "Statement":[
                        {
                            "Action":"ec2:GetEbsEncryptionByDefault",
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"GetEbsEncryptionByDefault"
                        },
                        {
                            "Action":"s3:GetBucketPublicAccessBlock",
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"GetBucketPublicAccessBlock"
                        },
                        {
                            "Action":[
                                "elasticfilesystem:DescribeReplicationConfigurations",
                                "elasticfilesystem:DescribeLifecycleConfiguration",
                                "elasticfilesystem:DescribeFileSystemPolicy",
                                "elasticfilesystem:DescribeBackupPolicy",
                                "elasticfilesystem:DescribeAccountPreferences",
                                "elasticfilesystem:DescribeAccessPoints"
                            ],
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"EFS"
                        },
                        {
                            "Action":[
                                "elasticmapreduce:ListInstanceGroups",
                                "elasticmapreduce:ListInstanceFleets",
                                "elasticmapreduce:ListBootstrapActions"
                            ],
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"EMR"
                        },
                        {
                            "Action":[
                                "sagemaker:GetModelPackageGroupPolicy",
                                "sagemaker:GetLineageGroupPolicy"
                            ],
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"SAGEMAKER"
                        }
                    ],
                    "Version":"2012-10-17"
                }
            },
            "arn:aws:iam::aws:policy\/SecurityAudit"
        ]
    }
]
TypeNameAccountTrust RelationshipsPermissions
aws_iam_rolerole/lacework-ct-iam-<UNIQUE_ID><AWS_ACCOUNT_ID>
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<EXTERNAL_ID&rt;"
                }
            },
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::434813966438:root"
            },
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}
[
    {
        "name": "lacework-ct-cross-acct-policy-<UNIQUE_ID&rt;",
        "policy": {
            "Statement": [
                {
                    "Action": "s3:Get*",
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::lacework-ct-bucket-<UNIQUE_ID&rt;/*",
                    "Sid": "ReadLogFiles"
                },
                {
                    "Action": "kms:Decrypt",
                    "Effect": "Allow",
                    "Resource": "arn:aws:kms:us-east-1:<AWS_ACCOUNT_ID&rt;:key/<KMS_KEY_ID&rt;",
                    "Sid": "DecryptLogFiles"
                },
                {
                    "Action": "kms:Decrypt",
                    "Effect": "Allow",
                    "Resource": "arn:aws:kms:us-east-1:<AWS_ACCOUNT_ID&rt;:key/<KMS_KEY_ID&rt;",
                    "Sid": "DecryptQueueFiles"
                },
                {
                    "Action": "iam:ListAccountAliases",
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "GetAccountAlias"
                },
                {
                    "Action": "s3:ListBucket",
                    "Condition": {
                        "StringLike": {
                            "s3:prefix": "*AWSLogs/"
                        }
                    },
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::lacework-ct-bucket-<UNIQUE_ID&rt;",
                    "Sid": "ListLogFiles"
                },
                {
                    "Action": [
                        "sqs:ReceiveMessage",
                        "sqs:GetQueueUrl",
                        "sqs:GetQueueAttributes",
                        "sqs:DeleteMessage"
                    ],
                    "Effect": "Allow",
                    "Resource": "arn:aws:sqs:us-east-1:<AWS_ACCOUNT_ID&rt;:lacework-ct-sqs-<UNIQUE_ID&rt;",
                    "Sid": "ConsumeNotifications"
                },
                {
                    "Action": [
                        "sns:ListTopics",
                        "sns:ListSubscriptions",
                        "sns:GetTopicAttributes",
                        "s3:GetBucketPolicy",
                        "s3:GetBucketLocation",
                        "cloudtrail:GetTrailStatus",
                        "cloudtrail:DescribeTrails"
                    ],
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "Debug"
                }
            ],
            "Version": "2012-10-17"
        }
    }
]
aws_iam_rolerole/lw-iam-<UNIQUE_ID><AWS_ACCOUNT_ID>
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "lweid:aws:v2:<ACCOUNT&rt;:<AWS_ACCOUNT_ID&rt;:<UNIQUE_ID&rt;"
                }
            },
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::434813966438:root"
            },
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}
[
    {
        "name": "lwaudit-policy-<UNIQUE_ID&rt;",
        "policy": {
            "Statement": [
                {
                    "Action": "ec2:GetEbsEncryptionByDefault",
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "GetEbsEncryptionByDefault"
                },
                {
                    "Action": "s3:GetBucketPublicAccessBlock",
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "GetBucketPublicAccessBlock"
                },
                {
                    "Action": [
                        "elasticfilesystem:DescribeReplicationConfigurations",
                        "elasticfilesystem:DescribeLifecycleConfiguration",
                        "elasticfilesystem:DescribeFileSystemPolicy",
                        "elasticfilesystem:DescribeBackupPolicy",
                        "elasticfilesystem:DescribeAccountPreferences",
                        "elasticfilesystem:DescribeAccessPoints"
                    ],
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "EFS"
                },
                {
                    "Action": [
                        "elasticmapreduce:ListInstanceGroups",
                        "elasticmapreduce:ListInstanceFleets",
                        "elasticmapreduce:ListBootstrapActions"
                    ],
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "EMR"
                },
                {
                    "Action": [
                        "sagemaker:GetModelPackageGroupPolicy",
                        "sagemaker:GetLineageGroupPolicy"
                    ],
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "SAGEMAKER"
                }
            ],
            "Version": "2012-10-17"
        }
    },
    "arn:aws:iam::aws:policy/SecurityAudit"
]

Cloud Audit Control Tower Integration

Cloud Audit via Control Tower 📎
The diagram below outlines an alternative cloud audit event delivery architecture for customer who have an existing consolidated cloudtrail S3 bucket provisioned via Control Tower.Lacework Control Tower Architecture
Permissions Required for Cloud Audit Control Tower Deployment 📎

Cloud Audit Control Tower Integration

The permissions outlined here are required when using the default terraform configuration and applicable to the target account for integration:
View JSON 📎

Audit Account

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "organizations:DescribeOrganization",
                "sns:GetSubscriptionAttributes",
                "sns:Subscribe",
                "sns:Unsubscribe",
                "sqs:CreateQueue",
                "sqs:DeleteQueue",
                "sqs:GetQueueAttributes",
                "sqs:ListQueueTags",
                "sqs:SetQueueAttributes"
            ],
            "Resource": "*"
        }
    ]
}

Log Archive Account

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:CreatePolicy",
                "iam:CreateRole",
                "iam:DeletePolicy",
                "iam:DeleteRole",
                "iam:DetachRolePolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:ListAttachedRolePolicies",
                "iam:ListInstanceProfilesForRole",
                "iam:ListPolicyVersions",
                "iam:ListRolePolicies",
                "iam:TagRole"
            ],
            "Resource": "*"
        }
    ]
}
ScopePermission
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:AttachRolePolicy
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:CreatePolicy
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:CreateRole
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:DeletePolicy
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:DeleteRole
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:DetachRolePolicy
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:GetPolicy
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:GetPolicyVersion
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:GetRole
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:ListAttachedRolePolicies
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:ListInstanceProfilesForRole
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:ListPolicyVersions
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:ListRolePolicies
<AWS_LOG_ARCHIVE_ACCOUNT_ID>iam:TagRole
Permissions Used in Operation 📎
The list of the various least-privilege roles deployed as part of Cloud Security and Compliance via Terraform or Cloudformation:

View JSON 📎
[
    {
        "Type":"aws_iam_role",
        "Name":"role\/lacework-ct-iam-<UNIQUE_ID>",
        "Account":"<AWS_LOG_ARCHIVE_ACCOUNT_ID>",
        "Trust Relationships":{
            "Statement":[
                {
                    "Action":"sts:AssumeRole",
                    "Condition":{
                        "StringEquals":{
                            "sts:ExternalId":"lweid:aws:v2:<ACCOUNT>:<AWS_ACCOUNT_ID>:<UNIQUE_ID>"
                        }
                    },
                    "Effect":"Allow",
                    "Principal":{
                        "AWS":"arn:aws:iam::434813966438:root"
                    },
                    "Sid":""
                }
            ],
            "Version":"2012-10-17"
        },
        "Permissions":[
            {
                "name":"lacework-ct-cross-acct-policy-<UNIQUE_ID>",
                "policy":{
                    "Statement":[
                        {
                            "Action":"s3:Get*",
                            "Effect":"Allow",
                            "Resource":"arn:aws:s3:::aws-controltower-logs-<AWS_LOG_ARCHIVE_ACCOUNT_ID>-us-east-1\/<AWS_ORG_ID>\/*AWSLogs\/*",
                            "Sid":"ReadLogFiles"
                        },
                        {
                            "Action":"iam:ListAccountAliases",
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"GetAccountAlias"
                        },
                        {
                            "Action":"s3:ListBucket",
                            "Condition":{
                                "StringLike":{
                                    "s3:prefix":[
                                        "*AWSLogs\/"
                                    ]
                                }
                            },
                            "Effect":"Allow",
                            "Resource":"arn:aws:s3:::aws-controltower-logs-<AWS_LOG_ARCHIVE_ACCOUNT_ID>-us-east-1\/<AWS_ORG_ID>\/*AWSLogs\/*",
                            "Sid":"ListLogFiles"
                        },
                        {
                            "Action":[
                                "sqs:ReceiveMessage",
                                "sqs:GetQueueUrl",
                                "sqs:GetQueueAttributes",
                                "sqs:DeleteMessage"
                            ],
                            "Effect":"Allow",
                            "Resource":"arn:aws:sqs:us-east-1:<AWS_AUDIT_ACCOUNT_ID>:lacework-ct-sqs-<UNIQUE_ID>",
                            "Sid":"ConsumeNotifications"
                        },
                        {
                            "Action":[
                                "sns:ListTopics",
                                "sns:ListSubscriptionsByTopic",
                                "sns:ListSubscriptions",
                                "sns:GetTopicAttributes",
                                "sns:GetSubscriptionAttributes",
                                "s3:ListAllMyBuckets",
                                "s3:GetBucketPolicy",
                                "s3:GetBucketLogging",
                                "s3:GetBucketLocation",
                                "s3:GetBucketAcl",
                                "cloudtrail:ListPublicKeys",
                                "cloudtrail:GetTrailStatus",
                                "cloudtrail:GetTrail",
                                "cloudtrail:DescribeTrails"
                            ],
                            "Effect":"Allow",
                            "Resource":"*",
                            "Sid":"Debug"
                        }
                    ],
                    "Version":"2012-10-17"
                }
            }
        ]
    }
]
TypeNameAccountTrust RelationshipsPermissions
aws_iam_rolerole/lacework-ct-iam-<UNIQUE_ID><AWS_LOG_ARCHIVE_ACCOUNT_ID>
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "lweid:aws:v2:<ACCOUNT&rt;:<AWS_ACCOUNT_ID&rt;:<UNIQUE_ID&rt;"
                }
            },
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::434813966438:root"
            },
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}
[
    {
        "name": "lacework-ct-cross-acct-policy-<UNIQUE_ID&rt;",
        "policy": {
            "Statement": [
                {
                    "Action": "s3:Get*",
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::aws-controltower-logs-<AWS_LOG_ARCHIVE_ACCOUNT_ID&rt;-us-east-1/<AWS_ORG_ID&rt;/*AWSLogs/*",
                    "Sid": "ReadLogFiles"
                },
                {
                    "Action": "iam:ListAccountAliases",
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "GetAccountAlias"
                },
                {
                    "Action": "s3:ListBucket",
                    "Condition": {
                        "StringLike": {
                            "s3:prefix": [
                                "*AWSLogs/"
                            ]
                        }
                    },
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::aws-controltower-logs-<AWS_LOG_ARCHIVE_ACCOUNT_ID&rt;-us-east-1/<AWS_ORG_ID&rt;/*AWSLogs/*",
                    "Sid": "ListLogFiles"
                },
                {
                    "Action": [
                        "sqs:ReceiveMessage",
                        "sqs:GetQueueUrl",
                        "sqs:GetQueueAttributes",
                        "sqs:DeleteMessage"
                    ],
                    "Effect": "Allow",
                    "Resource": "arn:aws:sqs:us-east-1:<AWS_AUDIT_ACCOUNT_ID&rt;:lacework-ct-sqs-<UNIQUE_ID&rt;",
                    "Sid": "ConsumeNotifications"
                },
                {
                    "Action": [
                        "sns:ListTopics",
                        "sns:ListSubscriptionsByTopic",
                        "sns:ListSubscriptions",
                        "sns:GetTopicAttributes",
                        "sns:GetSubscriptionAttributes",
                        "s3:ListAllMyBuckets",
                        "s3:GetBucketPolicy",
                        "s3:GetBucketLogging",
                        "s3:GetBucketLocation",
                        "s3:GetBucketAcl",
                        "cloudtrail:ListPublicKeys",
                        "cloudtrail:GetTrailStatus",
                        "cloudtrail:GetTrail",
                        "cloudtrail:DescribeTrails"
                    ],
                    "Effect": "Allow",
                    "Resource": "*",
                    "Sid": "Debug"
                }
            ],
            "Version": "2012-10-17"
        }
    }
]