One of the 1st things you have to do with multi cloud defense is actually tell us a little bit about your cloud service providers. So we go through what we call an onboarding process regardless if you're using AWS, Azure.00:05OCI, you know, through Oracle or even Google Cloud. Now the process differs slightly, so in this video, we're actually gonna talk about how to properly onboard Amazon's AWS specifically using the cloudformation template. So join us as we move through the process of using the SAS controller's automated workflows to.00:18Onboard AWS into multi cloud defense.00:38So now we're gonna go into the onboarding of a multi cloud defense and specifically around AWS. So what you'll see is I currently have a completely empty AWS account that I set up specifically for the purposes of this demo.00:45I'm gonna pivot back into multi cloud defense and launch the cloud formation template that is part of our onboarding wizard. You'll notice it does launch directly into that account that I had opened in the other tab, and what I like to highlight to a lot of customers is that you can actually pull down the exact YAML file that this cloudformation template is comprised of.00:59We'll just download it now. I'll kind of show you that you can look into it, see the different permissions that it was gonna provision. It is possible to modify this and we do have some kind of like discovery only templates that we could also use, but by default these are gonna be the permissions.01:19That are assigned to the three roles that will be provisioning as part of this cloud formation deployment within AWS. Now, the stack name, you can name this whatever you want. Typically if we onboard, the same account in a multiple.01:38Multi cloud defense, controllers you give them different names so that the stack name's a little bit different, otherwise you'll get criped at. This prod name, you don't want to change this. This actually correlates. If you look at the actual URL of the multi cloud defense controller, that actually correlates back.01:54To that prod one within that URL. This is also the multi cloud defense account number, so you don't wanna change that. And then this external ID is gonna be what we leverage within the controller account to kind of specifically bind.02:11This to your multi cloud defense tenant. This prefix name is modifiable. You can, you can, you know, basically type in whatever you want. I do recommend leaving Cisco MCD in there, but what you'll see is it's the prefix used for the three roles that will actually provision within there.02:27We will have an S3 bucket being deployed. Now, by default it's gonna install a new cloud trail so that we can listen for specific events related to inventory and object creation. I would recommend leaving that to true unless you already have a cloud trail within your account that we can leverage.02:44So it is gonna go through and start to deploy this. I'm gonna speed this up, but essentially, once this finishes, we should be able to go in and look at the outputs tab, which will contain all the information we need to kind of complete the onboarding of.03:02AWS into our multi cloud defense tenant. So i'll speed this up just a little bit and now we should be done, and we are. So what I'll do is I'll grab the outputs and don't worry I'm gonna close this account well before these videos ever get published, but.03:21We'll grab this information and we'll kind of just paste it in one by one, starting with the account number, and this is the normal flow, this is what I do, you know, for most customers we set up in production or for povs.03:42The account name is gonna be arbitrary. You cannot use any spaces within here, so just be cognizant of that if you're trying to hit the space bar. We'll call this the AWS demo account. I won't do a description, but you can put a vague description in there of what account it is.03:58The controller IAM role, that is gonna tie. If you look at the naming of this, controller I M is actually the AR n. So just go ahead and pull down that MCD controller ARN. We'll copy it in.04:13And then we will do the same thing with the inventory role and this should complete the onboarding. It'll kind of go through a little validation step here.04:30After we click next, and then you'll see depending on the size of your account and how much inventory is in the, the time that this possibly will take might vary a little bit. This being an empty account, it completes pretty quickly, same as the discovery of those underlying.04:48The assets within that account. So we can successfully say that we have onboarded this account, but we do wanna go in and validate that. So I'm gonna close out of this and I'm gonna pivot up at the top here to manage.05:08And under cloud accounts, we'll go to inventory. There we go. So notice all the metadata, the inventory objects that we're, we're picking up now. We'll.05:25Kinda look at vpcs and vnets. We have 17, so we actually subscribe to Cloudtrail for events. So because of this, you know, in addition to our periodic polling, if we were to go in and configure something like a new VPC.05:40We should almost in real time see that number increment to 18 unless somebody, you know, removes one while we're doing it. But I know that's not possible right now. So I'll just create one called testing inventory VPC. We'll give it a fake cider.05:56And we'll submit it and what we should be able to kind of validate is that that number increments from 17 to 18 vpcs and we should be able to see that VPC within there. So we'll pivot back.06:13To multi cloud defense and hit refresh here. Notice the VPCV nets does increment to 18 again this is because we we kind of subscribe to these pub sub buses of these different providers.06:30And if we're looking down through this list, let's refresh it one more time, maybe.06:45Oh, I only had 15. Yeah, let's click on page two and yeah, we see the testing inventory VPC listed here. So again, we know we've, we've kind of successfully onboarded the inventory piece is at least working.07:04So let's take a look at the AWS account within multi cloud defense. One thing you may wanna do is manage your inventory depending on the wizard or the procedure that you use to onboard these, it's going to possibly just enable inventory for every region. Now, if you're not in every region.07:16You may see, some errors because of this, because maybe some, you know, organizational policy that you guys have in place is not allowing you to use specific regions. So what I like to do is just limit it to the regions that we have inventory assets in. So let me change that up here.07:34Now, within AWS, it's sometimes fun to kind of look and see what happened on the AWS side. So I'll kind of pivot over to AWS console and specifically the IAM roles section, and you can see the three different roles that were provisioned, the controller role, the gateway role, and the inventory role.07:57Now, if you look into these, each is gonna have a, a applied section of policy that it is a little bit different. One thing I will note here is you can look in the onboard documentation, and there is a connecting AWS portion of this where it does go into a little bit of detail around.08:16Permissions are on the applied to those roles, why those three roles exist. Again, the controller role is just gonna be used from the SAS controller accessing the AWS API.08:36The gateway role is gonna be for anything, you know, permissions wise attached to the multi cloud defense gateways, which are also the firewall devices. And then the inventory role is what we're using for, of course, inventory based purposes. We also provision an S3 bucket.08:46Again, we we do try to minimize the costs associated with these things, so the S3 bucket, when you start to look through the properties and the different management properties of these, you're gonna notice things like it's only got a day of retention, so everything's deleted after a day because the controller should be pulling those out as they're hit within that.09:01Bucket, and then the permissions are fairly locked down in terms of what has the capability to pull from the bucket and put objects into that bucket. So we'll kind of just scroll slowly here and show the different permissions of this S3 bucket.09:21The last thing we'll look at is the cloud trail. This cloud trail again is provisioned as part of that onboarding process.09:48And again, it's just a very simple trail where we're looking at those different management based events or the API events. And again, that's so we can do this kind of inventory tracking in almost real time. It allows us to create, you know, firewall resources like object groups or what we call addresses and we can populate them.09:55Using this metadata that we pull in from these various cloud providers, very, very strong.10:15In terms of like dynamic based policy, but all of that's driven through these pub sub mechanisms, which are of course different between the various CSPs, but within AWS it is using Cloudtrail. I also really quickly wanted to touch on the documentation around this. So we have a couple sections within the user guide, so if you if you kinda look in multi cloud.10:20Defense. There's a little question mark in the top right hand corner. If you go directly to the documentation, it'll pivot you.10:40Essentially to this page. Now there are a couple of places where we talk about onboarding these accounts. So if you look under the multi cloud defense user guide, you'll see the setting up the multi cloud defense with the wizard. There is a connect cloud account. If you click on AWS, this is mainly talking about the cloud formation template approach. If you want a little.10:47Little bit more detail. I recommend pivoting out of that and going into the account onboarding section. And if you click on AWS, everything under here is gonna be a little bit more detailed than what you found earlier, and when I find.11:07Particularly intriguing, is they do provide, hey, if you were wanting to do all of this manually, here are kind of the overview of the steps we go through in the cloud formation template. And we do get a lot of questions about, hey, what are you guys kind of doing under the hood with this cloud formation template? What's actually happening? And we walk through.11:20Those roles that we create.11:39Down here. So there's three roles essentially like I talked about earlier, the controller role, the gateway role. This is actually like a firewall role. It's attached to the virtual machine or EC two instances that we deploy, and then the inventory role. We actually show all of the different permissions associated with these within here.11:41What I'd like to highlight though is with regards to like the gateway role, what we're giving them permissions to do is really just from an S3 perspective putting and listing things in. This is if we're, you know, doing any sort of logging and as well as like the KMS, so if we if we are wanting to pull certificates at a later stage.12:01Out of like an Amazon KMS store, this is where those gateways actually have the permissions to do so. Lastly are the inventory roles. These are really, again, just so that we can dynamically pull that inventory out of your AWS accounts.12:19So the metadata that we can use later in terms of policy and that we can subscribe to cloud trail so that we can get those, you know, those updates, those move, add, change, and deletions kind of in real time by getting notifications from the provider. This is where all of that kind of comes together and Amazon's actually.12:34Able to notify us if any changes have been made and we're able to pull down those changes. So this, this again is the inventory page. If you need to go to it, great, if you never need to because you're just using the wizard and you're able to fly through that without any problems, that's also great.12:53As always, if you found this video useful, keep a key eye on this channel as we will be releasing more and more content around the deployment and uses of multi cloud defense and how you can use it to protect your cloud infrastructure. Thank you for watching.13:14We look forward to seeing you in the next video.13:25
