Roles created by Multicloud Defense

When you onboard a cloud service account to Multicloud Defense Controller with the provided script, user roles are created within the parameters of the cloud service provider to ensure communication between services. Depending on the cloud service provider, different roles and permissions are created.

These roles are created when you onboard an account:

• MCDControllerRole

• MCDInventoryRole

A controller role is a cross-account IAM role that

• allows Multicloud Defense to access your cloud resources.

• permits actions like create EC2 instances, load balancers, and modifying Route53 entries.

• uses the Multicloud Defense-controller-account service principal with an external ID for security.

IAM Policy Example

Here is an example of the IAM policy applied to the role. The controller role name used in this example is Multicloud Defense-controller-role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "acm:DescribeCertificate",
        "aacm:ListCertificates",
        "apigateway:Get",
        "bedrock:Get*",
        "bedrock:List*",
        "bedrock:Retrieve",
        "ec2:*",
        "elasticloadbalancing:*",
        "events:*",
        "globalaccelerator:*"
        "iam:ListPolicies",
        "iam:ListRoles",
        "iam:ListRoleTags",
        "logs:*",
        "route53resolver:*",
        "servicequotas:GetServiceQuota",
        "s3:ListAllMyBuckets",
        "s3:ListBucket",
        "wafv2:Get*",
        "wafv2:List*,
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "iam:GetRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:iam::<ciscomcd-account>:role/ciscomcd-controller-role"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::<S3Bucket>/*"
    },
    {
      "Action": [
        "iam:GetRole",
        "iam:ListRolePolicies",
        "iam:GetRolePolicy",
        "iam:PassRole"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:iam::<customer- account>:role/ciscomcd_firewall_role"
    },
    {
      "Action": "iam:CreateServiceLinkedRole",
      "Effect": "Allow",
      "Resource": "arn:aws:iam::*:role/aws-service-role/*"
    }
  ]
}

Service Principal:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::<ciscomcd-account>:root"
        ]
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "ciscomcd-external-id"
        }
      }
    }
  ]
}

Replace placeholders like <ciscomcd-account> and <S3Bucket> with actual values during implementation.

A MCDGatewayRole is an AWS IAM role that:

• is assigned to the Multicloud Defense Gateway (Firewall) EC2 instances,

• allows access to manage keys and storage, and

• supports encryption and storage functions.

The role enables access for the gateway instance to AWS Secrets Manager, AWS KMS for decrypting keys, and Amazon S3 for storing objects like PCAPs and technical support data. The service principal of this role is ec2.amazonaws.com.

IAM Policy Details

Here is the IAM policy applied to the role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::*/*"
    },
    {
      "Action": [
        "kms:Decrypt"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Note

You can download and customize the CloudFormation template to make the policy more restrictive. For example, restricting decryption to specific keys, or object storage to a specific S3 bucket.

MCDInventoryRole is a specialized role that:

• facilitates the dynamic inventory process,

• allows CloudTrail events to be transferred to AWS account of the Controller, and

• enables direct event sending from the customer's AWS account to the Controller's webhook server.

Role Features:

• Put events on the event bus in the AWS account where the Multicloud Defense Controller exists.

• Send events matching the rule to the Multicloud Defense Controller's webhook server directly from the customer's AWS account.

The Service Principal for this role is events.amazonaws.com.

Policy Example:

Here is the policy applied to the role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "events:PutEvents",
      "Effect": "Allow",
      "Resource": [
        "arn:aws:events:*:<ciscomcd-account>:event-bus/default"
      ]
    }
  ]
}

The InventoryMonitorRule identifies and processes AWS CloudTrail inventory events relevant to Cisco Multicloud Defense.

It operates on the AWS account where the Multicloud Defense Controller is running, targeting specific CloudTrail events.

• Matches specific event patterns occurring in the customer's AWS account.

• Sends matched events to the webhook server of the controller.

Custom Event Pattern:

{
  "detail-type": [
    "AWS API Call via CloudTrail",
    "EC2 Instance State-change Notification"
  ],
  "source": [
    "aws.ec2",
    "aws.elasticloadbalancing",
    "aws.apigateway"
  ]
}

Target:

Event Bus in another AWS Account (mcd-account) using the MCDInventoryRole

An Azure IAM role is a set of permissions for Azure resources that:

• allows applications to read inventory information,

• allows the creation of resources like VMs and load balancers, and

• has customizable permissions through a JSON file.

To create a custom role for the Multicloud Defense Controller, navigate to your Azure subscription and click Access Control (IAM).

You need to name the role and customize the JSON file, specifying all permissions that allow communication and data transfer between your subscription and the Multicloud Defense Controller. A list of permissions typically required:

"Microsoft.ApiManagement/service/*", 
"Microsoft.Compute/disks/*", 
"Microsoft.Compute/images/read", 
"Microsoft.Compute/sshPublicKeys/read", 
"Microsoft.Compute/virtualMachines/*", 
"Microsoft.ManagedIdentity/userAssignedIdentities/read", 
"Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", 
"Microsoft.Network/loadBalancers/*", 
"Microsoft.Network/natGateways/*", 
"Microsoft.Network/networkinterfaces/*", 
"Microsoft.Network/networkSecurityGroups/*", 
"Microsoft.Network/publicIPAddresses/*", 
"Microsoft.Network/routeTables/*", 
"Microsoft.Network/virtualNetworks/*", 
"Microsoft.Network/virtualNetworks/subnets/*", 
"Microsoft.Resources/subscriptions/resourcegroups/*", 
"Microsoft.Storage/storageAccounts/blobServices/*", 
"Microsoft.Storage/storageAccounts/listkeys/action", 
"Microsoft.Network/networkWatchers/*", 
"Microsoft.Network/applicationSecurityGroups/*",
"Microsoft.Compute/diskEncryptionSets/read",
"Microsoft.Insights/Metrics/Read",
"Microsoft.Network/locations/serviceTagDetails/read",
"Microsoft.Network/locations/serviceTags/read",
"Microsoft.CognitiveServices/*/read",
"Microsoft.CognitiveServices/accounts/listkeys/action",
"Microsoft.Network/virtualHubs/*",
"Microsoft.Network/virtualHubs/hubRouteTables/*",
"Microsoft.MarketplaceOrdering/offertypes/publishers/offers/plans/agreements/*",
"Microsoft.Authorization/roleAssignments/read",
"Microsoft.Authorization/roleDefinitions/read"

This setup ensures that the Cisco Multicloud Defense application can access and manage your cloud resources effectively.

A Google Cloud IAM role is a permission category that

• grants access to certain resources,

• defines specific actions that can be performed within Google Cloud, and

• governs interactions with associated services like VPCs and storage.

This topic explains the details of the service accountes created by the CloudFormation template.

The CloudFormation template creates these accounts:

• ciscomcd-controller service account: Used by the Multicloud Defense Controller to:

  • Access your GCP project to create resources (Multicloud Defense Gateway) and load balancers for gateways.

  • Read information about the VPCs, subnets, security group tags, and more.

  • For additional steps for service account creation in the task on creating a GCP controller service account, refer to Overview of creating a GCP controller service account.

• ciscomcd-firewall service account: Assigned to the Multicloud Defense Gateway (compute VM instances).

  • Provides access to the secret manager (private keys for TLS decryption) and storage.

  • Send logs from the Multicloud Defense Gateway gateway to the GCP logging instance if configured. For more information, refer to Create a GCP firewall service account