AWS

Inspect all AWS resources

The Trustle AWS connector gathers a wide range of information from AWS to help you understand who has access to what, as well as how that access is used. Trustle gathers information about the following:

• All accounts on the platform (including human users and non-human / service accounts)
• All groups and membership in the groups
• All roles, who has access to roles, policies associated with roles, and usage
• All policies, including both managed and in-line policies, for resources on the system
• Services available and services accessible by each user
• Usage data for each user

Resources the AWS Connector Inspects

The AWS connector gathers a substantial amount of information from IAM, including usage data, that provides a detailed high-level view of how AWS is configured.

View all accounts on AWS

Because many accounts on AWS are used by “non-human” actors, many of the user accounts won’t appear in a corporate directory or identity provider. However, all accounts are discovered and represented in Trustle.

Monitor token rotation

AWS doesn’t enforce token rotation, but Trustle can alert you to tokens that have passed their stated expiry and that should be rotated.

Discover usage patterns

Trustle is able to monitor usage patterns for user accounts, groups, and roles and can recommend what level of access is actually needed. You can use Trustle to right-size privileges for each user, while allowing users to easily gain greater access as needed.

Manage access to AWS resources

With Provisioning enabled and with the Write policy active on AWS, the Trustle connector can automate changes to IAM. For example, when a user requests access to a resource and a manager approves, Trustle can automatically add the user’s account to the associated resources. This makes just-in-time access on AWS easy, manageable, and secure. Trustle maintains a history of all access requests, all workflows, and all changes to the system, so your security team and auditors can discover any evidence needed to show compliance.

With the information gathered from AWS and through usage data, Trustle makes recommendations for improving the security posture of the platform. For example, Trustle will recommend removing access from user accounts where the access is not needed (least privilege), removing user accounts that are no longer in use (account cleanup), and increasing the sensitivity rating on high risk resources. Trustle also recommends rotating tokens at set intervals and when to review specific accounts.

Additionally, Trustle highlights accounts with Access keys and Certificates that need rotation and accounts that need multi-factor authentication (MFA) enabled. Based on metrics of the sensitivity of the resource or service, compared with the amount of usage the account requires, Trustle also identifies opportunities to move these entitlements to Temporary or Just-in-Time, ensuring that access to these resources are guarded by “least privilege” principles.