Description
Allows generating temporary AWS (STS) credentials for use with CLI interfaces.
The connection component enables an organization to establish security controls, such as a strict RBAC policy, and to govern whoever seeks to access AWS using the AWS CLI tool.
It provides a way to request and generate time-limited credentials to be incorporated within the AWS CLI on any operating system.
This removes the need to use long-lived standing AWS Access Keys, providing access for unlimited time, which is a high-security concern especially when you do not have a way to protect and secure the credentials. The integration reduces this security risk by establishing JIT access with the AWS CLI.
This connection component should be linked to the “Amazon Web Services (AWS) Password Management" platform. The platform is included with PAM deployments, but can also be downloaded from CyberArk Marketplace:
https://cyberark-customers.force.com/mplace/s/#a3550000000EiACAA0-a3950000000jjSPAAY
More on how to onboard AWS roles to CyberArk PAM: CyberArk AWS Console with STS Connection Component – Example Configuration
Vendor
This connection component is designed for secure connection to the following target:
| Vendor | Amazon |
|---|---|
| Product | Amazon Web Services (AWS) |
| Product Category | Cloud Service |
| Product Versions | Current |
CyberArk
This connection component works with the following CyberArk versions:
| CyberArk Solution | Privileged Session Management |
|---|---|
| CyberArk Product | Privileged Session Manager (PSM) |
| CyberArk Versions | 9.x |
| Artifact Version | 1.0 |
| Out of the Box | NO |
| Out of the Box in versions | N/A |
Support & Certification
| Support Level | STANDARD |
|---|---|
| Developed by | CyberArk |
| Certification Level | CERTIFIED |
Linked Accounts
Logon Account
| Supported | YES |
|---|---|
| Required | YES |
| Platforms | AWS Access Keys |
| Permissions |
Prerequisites
The "Get Role" permission must be added to the AWS ARN Role in order for the connection component to function correctly.
Installation
Do the following to set up the connection component:
| Step | How To |
|---|---|
| Import the Connection Component | From PVWA navigate to Administration→Platforms, locate a relevant platform and select the "Manage PSM connectors" option. Upload the connector package, or select it if it already exists in the list |
| Import the executable | Copy the AWSCLI.exe file from the installation package to the Components subfolder of the Privileged Session Manager installation folder on the PSM machine. |
| Configure Connection Components Parameters | In the "Target Settings" → "Client Specific" configuration, configure the AWSSessionDurationDefault and AWSSessionDurationMax parameters accordingly. The "AWSProxyHost" and "AWSProxyPort" parameters can also be set (but are optional and can be omitted if no proxy is configured). |
Configuration
Connection Component Settings
Specify the following parameters at the connection component level:
Connection Component Root Level Parameters
Parameters that define generic settings of the PSM connection component.
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| Id | A unique ID that identifies the connection component | String | PSM-AWSCLI |
| DisplayName | The name to be displayed in the connection selection. | String | AWS CLI |
User Parameters section
Parameters that determine the information that users will be required to supply while initiating the PSM connection. These parameters can be overridden at platform or account level.
| Parameter Name | Description | Acceptable Values | Default Value | Visible | Required | Type | Enforce In Dual Control Request |
|---|---|---|---|---|---|---|---|
| AWSSessionDurationDefault | A default AWS session duration, displayed to an end-user upon application launch. Value is set in minutes. | Must be larger than or equal to 15 (minimum AWS session duration) Must be less than or equal to maximum AWS session duration of the AWS ARN role | 30 | No | Yes | Integer | No |
| AWSSessionDurationMax | A maximum AWS session duration that end-user would be able to set. Must not exceed the maximum session duration of the AWS ARN role. Value is set in minutes. | Must be less than or equal to maximum AWS session duration of the ARN role. | 90 | No | Yes | Integer | No |
| AWSProxyHost | A proxy host when establishing connection to AWS via AWS SDK. | A valid hostname | N/A | No | No | String | No |
| AWSProxyPort | A proxy port when establishing connection to AWS via AWS SDK. A proxy host must be configured for the proxy port to function properly. | A valid port | N/A | No | No | Integer | No |
Account Settings
Target Account Mandatory Parameters
Specify the following parameters on the target account:
| Parameter Name | Description | Acceptable Values |
|---|---|---|
| AWSAccountID | AWS Account ID | String |
| AWSARNRole | Full value of AWS ARN Role in a format defined by AWS | See the AWS documentation: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html |
The target account must be using OOB/Marketplace Amazon Web Services - AWS platform.
Logon Account Mandatory Parameters
Specify the following parameters on the logon account:
| Parameter Name | Description | Acceptable Values |
|---|---|---|
| AWSAccessKeyID | AWS Access Key ID of IAM user, generated in AWS | String |
| Access Key / AWS Secret Access Key | AWS Secret Access Key of IAM user, generated in AWS (stored as Access Key in CyberArk) | String |
The logon account must be using OOB/Marketplace Amazon Web Services - AWS - Access Keys platform.