Connect Amazon Web Services (AWS)

Imports your AWS account inventory and security posture: EC2 instances and images, network exposure (security groups, interfaces, Elastic IPs, route tables, load balancers), IAM identities and MFA, EBS volumes, S3 buckets, CloudTrail and WAF.

For the general flow of adding a source, see Connect Data Sources.

Prerequisites

• AWS account with IAM management rights

• Primary AWS region to monitor

Setup

Step 1 — Create a read-only IAM policy

IAM → Policies → Create policy → JSON tab, paste:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "HarvenEc2Network",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeImages",
        "ec2:DescribeVolumes",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeSecurityGroupRules",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeAddresses",
        "ec2:DescribeRouteTables",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeTags"
      ],
      "Resource": "*"
    },
    {
      "Sid": "HarvenIam",
      "Effect": "Allow",
      "Action": [
        "iam:GetAccountAuthorizationDetails",
        "iam:GenerateCredentialReport",
        "iam:GetCredentialReport",
        "iam:ListUsers",
        "iam:ListMFADevices",
        "iam:ListRoles",
        "iam:ListPolicies",
        "iam:GetPolicyVersion"
      ],
      "Resource": "*"
    },
    {
      "Sid": "HarvenLoggingWaf",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "wafv2:ListWebACLs",
        "wafv2:GetWebACL",
        "wafv2:GetWebACLForResource",
        "wafv2:ListResourcesForWebACL",
        "wafv2:GetLoggingConfiguration",
        "wafv2:ListIPSets",
        "wafv2:GetIPSet"
      ],
      "Resource": "*"
    },
    {
      "Sid": "HarvenS3",
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:GetBucketVersioning",
        "s3:GetEncryptionConfiguration",
        "s3:GetBucketLogging",
        "s3:GetBucketPublicAccessBlock",
        "s3:GetBucketPolicyStatus",
        "s3:GetBucketTagging"
      ],
      "Resource": "*"
    }
  ]
}

Simpler alternative: attach the AWS managed policy SecurityAudit, which covers all of these actions except wafv2:GetIPSet — add that one in an inline policy, otherwise the waf_ip_sets table stays empty.

Step 2 — Create an IAM user and access keys

1. IAM → Users → Create user (e.g., harven-connector)

2. Attach the policy created in Step 1

3. Security credentials → Create access key

4. Type: Application running outside AWS

5. Copy the Access Key ID and Secret Access Key

Fields to fill in HARVEN

Collected data

• ec2_instances — EC2 instances: Identification (instance_id, instance_type, instance_state, region), Exposure (public_ip_address, security_group_ids, network_interface_ids), Identity and IMDS (iam_instance_profile_arn, metadata_http_tokens)

• s3_buckets — S3 buckets: Identification (name, region, creation_date), Security (encryption_enabled, public_access_blocked, policy_status_is_public, logging_enabled)

• security_groups — Security group rules (one row per rule): Rule (group_id, direction, ip_protocol, from_port, to_port), Source (0.0.0.0/0 = internet) (source_cidr_ipv4, source_cidr_ipv6, prefix_list_id)

• network_interfaces — Network interfaces (ENIs): Attachment (attached_instance_id, interface_type, status), Exposure (public_ip, subnet_id, security_group_ids)

• elastic_ips — Elastic IPs: Association (none = orphan) (public_ip, association_id, instance_id)

• route_tables — Route tables: Subnets (associated_subnet_ids, is_main), Internet access (has_internet_gateway_route, has_nat_gateway_route)

• load_balancers — Load balancers: Identification (internet-facing = exposed) (load_balancer_name, scheme, type), Protection (security_group_ids, waf_web_acl_arn)

• load_balancer_listeners — Load balancer listeners: Listener (port, protocol, ssl_policy), authenticate-* = authentication enforced (default_action_type)

• iam_users — IAM users, including the root user: Identity and MFA (user_name, mfa_active, password_enabled), Usage (password_last_used, access_key_1_last_used_date), Privileges (is_admin, group_names)

• iam_roles — IAM roles: Identity and trust (role_name, last_used_date, trusts_external_account), Privileges (instance_profile_arns, is_admin)

• iam_policies — Attached IAM managed policies: Identification (policy_name, is_aws_managed, attachment_count), Scope (grants_admin, grants_wildcard_action)

• ebs_volumes — EBS volumes: Attachment (available = orphan) (volume_id, state, attached_instance_id), Encryption (encrypted, kms_key_id)

• images — AMIs in use and the account's own AMIs: Obsolescence (image_id, name, creation_date, deprecation_time), Provenance (owner_id, is_public)

• cloudtrail_trails — CloudTrail trails: Logging (is_multi_region_trail, is_logging, latest_delivery_time), Integrity (log_file_validation_enabled, kms_key_id)

• waf_web_acls — WAF web ACLs: Rules (default_action, rule_count, managed_rule_group_names), IP filtering and protected resources (referenced_ip_set_arns, associated_resource_arns)

• waf_ip_sets — WAF IP sets: Allowed or blocked CIDRs (name, scope, addresses)

Existing customers — update the policy

The added tables (network, IAM, EBS, AMIs, CloudTrail, WAF) need new IAM actions. Until the policy is updated they stay empty and a warning says so; ec2_instances and s3_buckets keep working.

Once the policy is updated, use the connector's Refresh tables action so it receives the new tables.

Regions and global data

• Regional tables (EC2, network, load balancers, EBS, AMIs, regional WAF) read the configured region and carry a region column. Reading several regions is available on request.

• IAM and CloudTrail are read once for the whole account. MFA data comes from the IAM credential report, which AWS caches for up to 4 hours.

• IAM MFA only covers IAM users: for federated access (IAM Identity Center, Entra ID, Okta…), MFA is checked in the identity provider.

Official documentation

• Manage IAM access keys

• SecurityAudit AWS managed policy

Need help? Contact [email protected].