AWS Integration

Overview

The AWS integration provides visibility into your cloud infrastructure security, including IAM configurations, S3 bucket policies, EC2 security groups, and more.

Prerequisites

• AWS account with admin access or IAM permissions to create roles
• Access to AWS Console or CLI
• List of AWS accounts to monitor (if using AWS Organisations)

Step 1: Create IAM Role

Create a cross-account IAM role for Bleach:

1. Navigate to IAM → Roles in AWS Console
2. Click "Create Role"
3. Select "Another AWS account" as trusted entity
4. Enter the Bleach AWS Account ID (provided in integration settings)
5. Enable "Require external ID" and enter the provided external ID

Step 2: Attach Policies

1. Attach the "SecurityAudit" AWS managed policy
2. Optionally attach "ViewOnlyAccess" for broader visibility
3. Name the role (e.g., "BleachSecurityRole")
4. Copy the Role ARN for the next step

Step 3: Configure in Bleach

1. Navigate to Integrations → AWS
2. Enter the Role ARN you created
3. Select AWS regions to monitor
4. Click "Verify Connection"

Step 4: Initial Assessment

1. Once connected, Bleach will scan your AWS environment
2. Initial scan covers IAM, S3, EC2, RDS, and more
3. Review findings in the Cloud Security dashboard
4. Prioritise remediation based on severity

What's Monitored

• IAM users, roles, and policies
• S3 bucket configurations and public access
• EC2 security groups and network ACLs
• RDS encryption and public accessibility
• CloudTrail logging configuration
• VPC flow logs and configurations

Multi-Account Setup

For AWS Organisations:

1. Create the IAM role in each account using CloudFormation StackSets
2. Add each account to Bleach with its Role ARN
3. View consolidated findings across all accounts