Connecting AWS

What you get

Once AWS is connected, Radius360 receives:

• IAM analysis. IAM users, root account MFA, and root access keys, from the IAM credential report.
• S3 configuration. Whether S3 Block Public Access is fully enabled at the account level.
• EC2 and networking. Security groups open to 0.0.0.0/0, EC2 instances, and unencrypted EBS volumes.
• Data stores and backup. RDS encryption and automated backups, OpenSearch and ElastiCache encryption at rest, AWS Backup plans and vault locks.
• CloudTrail and GuardDuty. Whether each service is enabled.
• Security Hub findings. If enabled, critical findings become risks automatically.
• Amazon Bedrock. If you use it, whether model-invocation logging and Guardrails are configured.

Framework controls that light up:

• SOC 2 CC6.1, CC6.6, CC7.1 (System Operations), CC7.2 (System Monitoring)
• ISO 27001:2022 A.5 (Organizational), A.8 (Technological), covering access, cryptography, logging, and network security
• NIST CSF 2.0 PR.AA (Access Control), PR.DS (Data Security), PR.IR (Infrastructure Resilience), DE.CM (Continuous Monitoring)
• HIPAA 164.308(a)(1), 164.312(a)(1), 164.312(e)(1) (for PHI-handling workloads)

Prerequisites

• An AWS account where you can create an IAM user and access key
• The AWS-managed SecurityAudit policy, plus backup:List*, rds:DescribeDBInstances, es:ListDomainNames, es:DescribeDomain, and elasticache:DescribeReplicationGroups
• About 10 minutes per account

Connecting AWS

1. 1
   In AWS IAM, create a dedicated user, attach SecurityAudit and the extra read permissions listed above, and create an access key for it.
2. 2
   In Radius360, open Integrations, find AWS Deep Security, and click Connect. Give the account a label (for example, "production").
3. 3
   Paste the Access Key ID and Secret Access Key, and enter your primary region (the region Radius360 reads Security Hub from). IAM, S3, EC2, EBS, Backup, and RDS are read across all enabled regions.
4. 4
   Click Save & Connect. Radius360 tests the connection before saving. Then click Sync to run the first sync.

The first sync takes 5 to 15 minutes depending on the size of your AWS footprint (number of regions, EC2 instances, IAM entities). Later syncs run on the schedule you picked, daily by default.

Multi-account setups

Each AWS account is connected as its own instance of the integration, with its own label. You have two ways to connect additional accounts:

1. A key per account. Create a read-only IAM user and access key in each account and connect each one separately.
2. One key, assumed roles. Keep a single access key and, in each other account, create a role with the same read-only permissions whose trust policy trusts that key's IAM user. When you connect the account, paste the same key plus the role's ARN in Role ARN. If the trust policy requires an external ID (AWS recommends one for third-party access), enter it in External ID. In this setup the key's user only needs sts:AssumeRole on those roles.

If you are a vCISO or MSSP and each client has their own AWS account, connect each account inside that client's Radius360 workspace.

Troubleshooting

AssumeRole fails. The role's trust policy no longer trusts the key's IAM user, the key's user lacks sts:AssumeRole on the role, or the external ID does not match. Fix the trust policy or the value in Radius360.

No Security Hub findings. Enable Security Hub in the primary region you entered. Radius360 reads findings from that region; if it is off, there is nothing to read.

A service shows no findings and no evidence. The key is probably missing a permission. Check the extra read permissions listed under Prerequisites first.

For complex setups (multi-region GovCloud, per-OU scoping, etc.), email support@radius360.co or ask the GRC Assistant.