Integration AWS with ShadowMap

ShadowMap allows seamless integration with your AWS environment to provide visibility into your external attack surface. This guide will walk you through creating an AWS IAM user with the necessary permissions and configuring ShadowMap to use these credentials.

Step 1: Create an AWS IAM User

1. Sign in to the AWS Management Console.

2. Navigate to IAM (Identity & Access Management).

3. Click on Users from the left menu and select Add user.

4. Provide a name for the user (e.g., ShadowMap-Integration).

5. Select Programmatic access as the access type.

Step 2: Attach the Required Permissions

1. Click Attach existing policies directly.

2. Click on Create policy to add custom permissions.

3. Switch to the JSON tab and enter the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation",
                "route53:ListCidrBlocks",
                "route53:ListHostedZones",
                "route53:ListHostedZonesByName",
                "elasticloadbalancing:DescribeLoadBalancers"
            ],
            "Resource": "*"
        }
    ]
}

4. Click Review policy, enter a name (e.g., ShadowMapPolicy), and create the policy.

5. Back in the IAM user creation flow, attach the newly created policy.

6. Click Next: Tags (optional), then Next: Review, and Create user.

7. Copy the Access Key ID and Secret Access Key for later use.

Step 3: Configure AWS in ShadowMap

1. Log in to your ShadowMap account.

2. Navigate to Settings -> Cloud Sources

3. Select Amazon Web Services Integration.

4. Create a new Configuration

5. Enter the Name, Region, Access Key ID and Secret Access Key.

6. Click Create Source to save and enable the integration.

How AWS Data is Used in ShadowMap

Once the AWS integration is complete, ShadowMap begins scanning relevant AWS services to enhance your external attack surface mapping. Specifically:

• EC2 instances: IP addresses and associated metadata are pulled and added to the ShadowMap scope.

• Route53: Hosted zones and DNS records are used to identify sub-domains and additional IPs.

• Elastic Load Balancers (ELB): Public-facing endpoints are included as part of your monitored infrastructure.

• S3 Buckets: Bucket names and their accessible URLs are identified and assessed for exposure.

These elements are then:

• Continuously monitored for changes.

• Automatically included in ShadowMap's scanning engine.

• Evaluated for vulnerabilities, misconfigurations, and threats.