When granting AWS access permissions, listing individual ARNs in IAM policies can quickly cause you to exceed AWS's inline policy character limit. Apono solves this through access scopes and the Apono Query Language (AQL). These solutions use regex patterns to efficiently manage resource groups instead of listing individual ARNs.

For additional protection, Apono has implemented a 100-resource threshold as a guardrail when individual ARN specification is needed.

The following sections explain how Apono prevents you from exceeding AWS's inline policy limit:

• Create strategic AWS resource groupings for access flows

• Understand how Apono provides clear warnings when the AWS policy limit is exceeded

• Learn how Apono maintains consistent behavior whether your team uses Portal, Teams, or Slack

For example, instead of individually specifying 200 S3 buckets in a policy (which would exceed AWS's limit), you can use resource tags to group them by environment or function.

Prerequisite

Admin Guidance

When defining access flows that include AWS resources, your resource definition strategy directly impacts policy management.

Questions

Before selecting AWS resources for an access flow, consider the following questions:

• Can all resources of an integration be selected?

• Have tags been applied to logically group resources by environment, function, or team?

• Can an access scope be created to group resources across multiple AWS integrations?

• Is individual resource selection truly necessary for security requirements?

Resource Definition Strategies

To effectively manage AWS permissions while avoiding policy character limits, you can use access scopes, integrations, or bundles. When possible, we strongly recommend using access scopes or AQL.

The following table explains the strategy for each approach.

Apono Safeguard

If you select too many AWS resources for an access flow, the Apono UI will display a warning message instructing you to reduce the number of selected resources.

Requestor Guidance

When requesting access to many AWS resources, Apono will warn you if you have selected too many AWS resources.

You will receive different notifications about AWS resource limits depending on which platform you use to submit your access request:

• Portal & Teams: Apono displays a warning before submission when you click Request, preventing requests that exceed the limit.

• Slack: Apono processes your request first, then sends a message if you need to resubmit with fewer resources.

Known Limitations While Building Access Flows And Bundles

The following configurations within access flows or when bundling multiple resources will exceed AWS policy size constraints.

• Specifying resources by name: Individually choosing resource names.

• S3 buckets: as AWS does not support tagging buckets, it should be handled with region tags or through access scopes or AQL patterns where possible.

• Excluding a list of resource names: choosing a list of resources to exclude can similarly inflate policy size and is best handled through access scopes or AQL patterns where possible.

Discover RDS Instances in AWS

AWS RDS PostgreSQL and MySQL databases provide powerful and flexible relational database services in the cloud. This guide shows you how to enable Apono to discover and manage your AWS RDS databases, including MySQL and PostgreSQL instances.

Prerequisites

Before you start, ensure you have:

1. One or more Apono AWS connectors installed with network access to your AWS RDS databases.

• Minimum required version: 1.5.3

1. Permissions to create and manage AWS Secrets Store secrets and tag RDS instances.

Steps to Enable SQL Database Discovery

To enable Deep Discovery for your AWS RDS databases, you will need to tag your database instances with specific key-value pairs. The tagging process varies based on your authentication method.

Create credentials to the RDS instances.

• Read more on RDS MySQL here.

• Read more on RDS PostgreSQL here.

Option 1: For Databases with IAM Authentication

1. Tag your RDS database instance with the following key-value pairs:

   Key

   Value

   auth_type

   iam-auth

   apono-connector-id

   The ID of the Apono connector in the same account as the database

Option 2: For Databases with Username and Password Authentication

1. Tag your RDS database instance with the following key-value pairs:

   Key

   Value

   auth_type

   user-password

   apono-connector-id

   The ID of the Apono connector in the same account as the database

   apono-secret

   The ARN of the secret containing the database credentials

   region

   The AWS region where the secret is stored

Set Up the Apono Integration

1. Go to the Integrations Catalog in the Apono web application.

2. Click "AWS" and select either "Account" or "Organization". Make sure to pick resources under Connect Sub Integrations:

1. Choose the Apono connector set up for your Account or Organization. Read more here.

2. Complete the integration by providing the required config.

3. Click Confirm.

After connecting your AWS Account or Organization to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration and sub-integrations for each RDS instance will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Now that you have completed this integration, you can create access flows that grant permission to RDS resources.

Troubleshooting

If RDS instances appear with errors in your Integrations page, follow these steps:

1. Check Tags: Verify all required tags are present and correctly formatted.

2. Connector Permissions: Ensure the Apono connector has necessary permissions to read tags and access secrets.

3. Network connectivity: Ensure each RDS instance has a connector with network access to the RDS.

Amazon Redshift is a fast, scalable, and secure fully managed data warehouse service in the cloud, serving as a primary data store for vast datasets and analytic workloads. Amazon Web Services (AWS) enables businesses to analyze their data using standard SQL and existing business intelligence tools, promoting insightful decision-making and integration with various AWS services.

Through this integration, Apono helps you securely manage access to your Amazon Redshift instance.

Prerequisites

"username": "REDSHIFT_USERNAME", 
"password": "PASSWORD"

CREATE USER apono_connector WITH PASSWORD 'password';
ALTER USER apono_connector WITH CREATEUSER;

Integrate Amazon Redshift

Follow these steps to complete the integration:

1. On the Catalog tab, click Amazon Redshift. The Connect Integration page appears.

2. Under Discovery, click Next. The Apono connector section expands.

3. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

   Setting

   Description

   Integration Name

   Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

   Hostname

   Hostname of the Amazon Redshift instance to connect

   Port

   Port value for the instance By default, Apono sets this value to 5439.

   Database Name

   Name of the database

3. Click Next. The Secret Store section expands.

4. Associate the secret or credentials.

5. Click Next. The Get more with Apono section expands.

6. Define the Get more with Apono settings.\

   Setting

   Description

   Credential Rotation

   User cleanup after access is revoked (in days)

   (Optional) Defines the number of days after access has been revoked that the user should be deleted

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

7. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your Amazon Redshift instance.

Troubleshooting

Refer to Troubleshooting Errors for information about errors that may occur.

EC2 via Systems Manager Agent (SSM)

Intro

This integration provides the ability to grant users permissions to connect to the EC2 with a secure connection - SSM.

Prerequisites

• An integration between Apono and the AWS Organization or Account where the EC2 is.

• EC2 machine with SSM agent installed. Installed by default in most EC2s docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent

• End users will need to install the session manager plugin for AWS CLI on the local user's computer. docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-working-with-install-plugin

Step-by-step guide

The EC2 instance role

Follow the steps below to create an EC2 instance role with the AmazonSSMManagedInstanceCore managed policy. Read more here.

1. In the AWS IAM, Click Create new IAM Role

   1. Click Create Role

   2. Choose the AWS Service option

   3. From the dropdown list, choose EC2

   4. Choose EC2 Role for AWS System Manager. Click Next.

   5. Verify that the AmazonSSMManagerInstanceCore policy is added. Click Next

   6. Fill the Role name box (for example, ec2-ssm)

   7. Click Create role

2. Go back to the Modify IAM Role page

   1. From the dropdown list, choose the new IAM role we created (ec2-ssm)

   2. Click Update IAM role

   3. Pleas note: it takes about 30 minutes for the AWS sync to finish.

Integrating Apono with the EC2 instances

1. In the Apono UI, edit an existing AWS Org or AWS Account integration or create a new one.

2. Add the EC2 Connect resource type.

3. Complete the integration and click Integrate.

Results

Apono should now discover EC2 machines! You can now create access flows to EC2 instances.

PostgreSQL databases are open-source relational database management systems emphasizing extensibility and SQL compliance. AWS enables developers to create cloud-hosted PostgreSQL databases.

Through this integration, Apono helps you securely manage access to your AWS RDS for PostgreSQL instances.

Prerequisites

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "rds-db:connect",
            "Resource": "arn:aws:rds-db:*:*:dbuser:*/apono_connector",
            "Effect": "Allow"
        }
    ]
}

Create an AWS RDS PostgreSQL user

You must create a user in your AWS RDS PostgreSQL instance for the Apono connector and grant that user permissions to your databases.

Follow these steps to create a user and grant it database permissions:

1. Create a new user with either Built-in authentication or IAM authentication.

CREATE USER apono_connector WITH PASSWORD 'secret_passwd';

CREATE USER apono_connector;
GRANT rds_iam TO apono_connector;

1. From your preferred client tool, grant rds_superuser access to the user.

ALTER USER apono_connector WITH CREATEROLE;
GRANT rds_superuser TO apono_connector;

1. (IAM authentication only) Create and attach the following IAM policy to your identity center permissions set or role.

{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Effect": "Allow",
             "Action": [
                 "rds-db:connect"
             ],
             "Resource": [
                 "arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
             ]
         },
         {
             "Effect": "Allow",
             "Action": [
                 "rds:DescribeDBInstances"
             ],
             "Resource": [
                 "arn:aws:rds:*:*:db:*"
             ]
         }
     ]
 }

1. (Built-in authentication only) Create an AWS secret with the credentials from step 1.

Integrate Amazon RDS for PostgreSQL

Follow these steps to complete the integration:

1. On the Catalog tab, click AWS RDS PostgreSQL. The Connect Integration page appears.

2. Under Discovery, click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.\

   Setting

   Description

   Integration Name

   Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

   Auth Type

   Authorization type for the MySQL service account user:

   • IAM Auth: IAM authentication

   • User / Password: Built-in authentication

   Region

   Location where the PostgreSQL database is deployed

   Instance ID

   ID of the PostgreSQL instance

   Database Name

   Name of the PostgreSQL database

   SSL Mode

   (Optional) Mode of Secure Sockets Layer (SSL) encryption used to secure the connection with the SQL database server

   • require: An SSL-encrypted connection must be used.

   • allow: An SSL-encrypted or unencrypted connection is used. If an SSL encrypted connection is unavailable, the unencrypted connection is used.

   • disable: An unencrypted connection is used.

   • prefer: An SSL-encrypted connection is attempted. If the encrypted connection is unavailable, the unencrypted connection is used.

   • verify-ca: An SSL-encrypted connection must be used and a server certification verification against the provided CA certificates must pass.

   • verify-full: An SSL-encrypted connection must be used and a server certification verification against the provided CA certificates must pass. Additionally, the server hostname is checked against the certificate's names.

   Enable Audit

   (Optional) Feature that allows Apono to ingest and aggregate session audit logs

3. Click Next. The Secret Store section expands.

4. Associate the secret or credentials.

1. Click Next. The Get more with Apono section expands.

2. Define the Get more with Apono settings.\

   Setting

   Description

   Credential Rotation

   User cleanup after access is revoked (in days)

   (Optional) Defines the number of days after access has been revoked that the user should be deleted

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

3. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your RDS for PostgreSQL database.

AWS Lambda enables you to build and connect cloud services and internal web apps by writing single-purpose functions that are attached to events emitted from your cloud infrastructure and services.

Its serverless architecture frees you to write, test, and deploy functions quickly without having to manage infrastructure setup.

With this integration, you can connect your internal applications to AWS Lambda functions and manage access to those applications with Apono.

Prerequisites

Before starting this integration, create the items listed in the following table.

function listResources(params) {
  return {
    resources: [
      {
        'id': 'resource1',
        'name': 'Resource 1',
        'type': params.resource_type,
        'metadata': {
          'key1': 'value1'
        }
      },
      {
        'id': 'resource2',
        'name': 'Resource 2',
        'type': params.resource_type,
        'metadata': {
          'key2': 'value2'
        }
      },
      {
        'id': 'resource3',
        'name': 'Resource 3',
        'type': params.resource_type,
        'metadata': {
          'key3': 'value3'
        }
      },
    ],
    permissions: [
      {
        'id': 'admin',
        'name': 'Admin'
      },
      {
        'id': 'reader',
        'name': 'Reader'
      }
    ]
  };
}
function grantAccess(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const permission = params.permission;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
console.log(param1)
console.log(param2)
return {
status: 'ok'
};
}
function revokeAccess(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const permission = params.permission;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
return {
status: 'ok'
};
}
function createCredentials(params) {
const username = params.username;
const grantId = params.grant_id;
const resources = params.resources;
const param1 = params.custom_parameters.param1
const param2 = params.custom_parameters.param2
return {
status: 'ok'
};
}
export const handler = async (event) => {
const params = event.params;
switch (event.event_type) {
case 'create-credentials':
return createCredentials(params);
case 'list-resources':
return listResources(params);
case 'grant-access':
return grantAccess(params);
case 'revoke-access':
return revokeAccess(params);
case 'create-credentials':
return {
status: 'ok',
secret: 'created-credentials-secret'
}
case 'reset-credentials':
return {
status: 'ok',
secret: 'reset-credentials-secret'
}
default:
return {
status: 'active'
};
}
};

Integrate an AWS Lambda Custom Integration

Follow these steps to complete the integration:

1. On the Catalog tab, click AWS Lambda Custom Integration. The Connect Integration page appears.

2. Under Discovery, click Next. The Apono connector section expands.

3. From the dropdown menu, select a connector.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

   Setting

   Description

   Integration Name

   Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

   Custom Parameters

   Key-value pairs to send to the lambda function For example, you can provide a lambda function with a redirect URL that is used for internal provisioning access and passed as part of the action requests.

   Region

   Region of the AWS Lambda instance

   Function Name

   Named of the AWS Lambda function

3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.\

   Setting

   Description

   Credential Rotation

   User cleanup after access is revoked (in days)

   (Optional) Defines the number of days after access has been revoked that the user should be deleted

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

5. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your AWS Lambda function.

If your organization uses Amazon Web Services (AWS) as a cloud platform, Apono's AWS integrations can help you securely manage access to your AWS cloud-based services and databases.

By identifying and transforming existing privileges, Apono can shift your cloud management from broad permissions to on-demand access flows.

Through our AWS integrations, Apono enables you to perform the following access tasks:

• Limit Access: Discover existing cloud privileges and convert them to just-in-time access flows.

• Enable Self-Service Access: Allow developers to request access to AWS services, buckets, and instances via Slack.

• Automate Approval Workflows: Create automatic approval processes for sensitive AWS resources.

• Restrict Third-Party Access: Grant third-parties (customers or vendors) time-based access to specific S3 buckets, RDS, or EC2 instances with MFA verification.

• Review Access: Audit user cloud access, permissions granted, and reasons for access across AWS.

In this article

Amazon RDS for MySQL is an open-source relational database management service in the cloud. Through AWS RDS MySQL integration, you will be able to integrate with AWS RDS MySQL:

• Database

• Table

• Role

Prerequisites

• If you already have AWS Apono connector:

  • Make sure the connector's minimum version is 1.5.3.

• If you still don't have AWS Apono connector:

Create AWS RDS MySQL Integration

Generate Credentials

Create user and grant permissions:

aws rds describe-db-instances \
  --filters "Name=engine,Values=mysql" \
  --query "*[].[Endpoint.Address,Endpoint.Port]"

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

CREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

aws rds describe-db-instances \
  --filters "Name=engine,Values=mysql" \
  --query "*[].[DBInstanceIdentifier,Endpoint.Address,Endpoint.Port]"

aws rds modify-db-instance \
    --db-instance-identifier DBInstanceIdentifier \
    --apply-immediately \
    --enable-iam-database-authentication

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

CREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

aws iam create-policy --policy-name RDSConnectPolicy --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances"
            ],
            "Resource": [
                "arn:aws:rds:*:*:db:*"
            ]
        }
    ]
}'

aws rds describe-db-instances ^
  --filters "Name=engine,Values=mysql" ^
  --query "*[].[Endpoint.Address,Endpoint.Port]"

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

CREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

aws rds describe-db-instances ^
  --filters "Name=engine,Values=mysql" ^
  --query "*[].[DBInstanceIdentifier,Endpoint.Address,Endpoint.Port]"

aws rds modify-db-instance ^
    --db-instance-identifier DBInstanceIdentifier ^
    --apply-immediately ^
    --enable-iam-database-authentication

mysql -h [Endpoint.Address] -P [Endpoint.Port] -u USER_NAME -p

CREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

aws iam create-policy --policy-name RDSConnectPolicy --policy-document '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "rds-db:connect"
            ],
            "Resource": [
                "arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "rds:DescribeDBInstances"
            ],
            "Resource": [
                "arn:aws:rds:*:*:db:*"
            ]
        }
    ]
}'

CREATE USER 'USER_NAME'@'%' IDENTIFIED BY 'PASSWORD';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

    Make sure that the DB instance is compatible with IAM authentication. Check the compatibility requirements in Region and version availability.
    

4. Choose Modify.
5. In the Database authentication section, choose Password and IAM database authentication to enable IAM database authentication. Choose Password authentication or Password and Kerberos authentication to disable IAM authentication.
6. Choose Continue.
7. To apply the changes immediately, choose Immediately in the Scheduling of modifications section.
8. Choose Modify DB instance.

CREATE USER USER_NAME IDENTIFIED WITH AWSAuthenticationPlugin AS 'RDS';

GRANT SHOW DATABASES ON *.* TO 'USER_NAME'@'%';
GRANT CREATE USER ON *.* TO 'USER_NAME'@'%';  
GRANT UPDATE ON mysql.* TO 'USER_NAME'@'%';
GRANT PROCESS ON *.* TO 'USER_NAME'@'%';
GRANT SELECT ON *.* TO 'USER_NAME'@'%';

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
        "Action": [
          "rds-db:connect"
        ],
      "Resource": [
        "arn:aws:rds-db:*:*:dbuser:*/${SAML:sub}"
      ]
    },
    {
      "Effect": "Allow",
        "Action": [
          "rds:DescribeDBInstances"
        ],
        "Resource": [
          "arn:aws:rds:*:*:db:*"
        ]
      }
  ]
}

Create Integration in Apono

2. In the Catalog page search for and select AWS RDS MySQL.

3. In Discovery step, select one or multiple AWS RDS MySQL resource types for Apono to discover.

4. In Apono connector step, select the connector with the required permissions to be used with your AWS RDS MySQL.

5. In Integration config step, provide the following information about your AWS RDS MySQL:

1. (Optional) In Get more with Apono step, you can set up the following:

Next Steps

Apono offers AWS users a simple way to centralize cloud management through our platform. Through a single integration, you can manage multiple AWS services across various accounts and organizations.

Integrate an AWS account

Prerequisites

• Apono connector installed in your AWS account

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS account:

1. On the Catalog tab, click AWS. The Connect Integrations Group page appears.

2. Under Discovery, click Amazon Account.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

   Setting

   Description

   Integration Name

   Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

   Region

   Region in which the organization runs

   AWS Profile Name

   (Optional) Name of the AWS profile By default, Apono sets this value to apono.

   Enable Audit

   (Optional) Feature that allows Apono to ingest and aggregate session audit logs

3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.

   Setting

   Description

   Credential Rotation

   User cleanup after access is revoked (in days)

   (Optional) Defines the number of days after access has been revoked that the user should be deleted

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Now that you have completed this integration, you can create access flows that grant permission to AWS IAM resources, such as AWS Roles.

Integrate an AWS organization

Prerequisites

• Apono connector installed in your AWS management account OR a connector with delegate permissions

• To sync and manage access to EC2 servers, make sure you add the AmazonSSMManagedInstanceCore policy to the connector's IAM role

Integration

Follow these steps to integrate Apono with your AWS organization:

1. On the Catalog tab, click AWS. The Connect Integrations Group page appears.

2. Under Discovery, click Amazon Organization.

3. Click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section expands.

2. From the dropdown menu, select a connector. Choosing a connector links Apono to all the services available on the account where the connector is located.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

   Setting

   Description

   Integration Name

   Unique, alphanumeric, user-friendly name used to identify this integration when constructing an access flow

   Region

   Region in which the organization runs

   AWS SSO Region

   Region for which your single sign-on is configured

   SSO Portal

   Management Account Role ARN

   Exclude Organization Unit IDs

   ID of organizational units to exclude Example: ou-aaa1-1111,ou-bbb2-2222

   Enable Audit

   (Optional) Feature that allows Apono to ingest and aggregate session audit logs

3. Click Next. The Get more with Apono section expands.

4. Define the Get more with Apono settings.

   Setting

   Description

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

5. Click Confirm.

After connecting your AWS account to Apono, you will be redirected to the Connected tab to view your integrations. The new AWS integration will initialize once it completes its first data fetch. Upon completion, the integration will be marked Active.

Now that you have completed this integration, you can create access flows that grant permission to AWS IAM resources, such as AWS Roles.

Troubleshooting

Please refer to our troubleshooting guide if you encounter errors while integrating.

​​

With Elastic Kubernetes Service (EKS) on AWS, EKS simplifies the management complexities of Kubernetes.

Through this integration, Apono helps you securely manage access to your AWS Elastic Kubernetes cluster.​

Prerequisites

​

Configure user authentication

Authentication can be completed with an Identity and Access Management IAM user or an IAM role. To grant a user access to an EKS cluster, the IAM user or IAM role must be mapped with a specific user identifier, such as an email address.Apono supports this mapping with an IAM role through AWS SSO or SAML federation from any identity provider (IdP).​

Create a new policy

Follow these steps to create a new policy:

1. Under Access management on the Identity and Access Management (IAM) page in AWS, click Policies > Create policy. The Specify permission page appears.

2. Click JSON.

3. Replace the default policy with the following policy. Be sure to replace the placeholder.

   Copy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "eks:DescribeCluster",
               "Resource": "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*"
           }
       ]
   }

   Placeholder

   Description

   <AWS_ACCOUNT_ID>

   AWS account ID where the EKS is hosted

4. Click Next. The Review and create page appears.

5. Enter a Policy name. This name is used to identify this policy.

6. Click Create policy.

​

Create the IAM role

Follow these steps to create the IAM role:

1. Under Access management on the Identity and Access Management (IAM) page in AWS, click Roles > Create role. The Select trusted entity page appears.

2. Under Trusted entity type, select Custom trust policy.

3. Under Custom trust policy, replace the default policy with one of the following trust policies. Be sure to replace the placeholders.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "sts:RoleSessionName": "${SAML:sub}"
                },
                "ArnLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*",
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_*"
                    ]
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:saml-provider/<SAML_PROVIDER>"
            },
            "Action": "sts:AssumeRoleWithSAML",
            "Condition": {
                "StringEquals": {
                    "SAML:aud": "https://signin.aws.amazon.com/saml"
                }
            }
        }
    ]
}

1. Click Next. The Add permissions page appears.

2. Under Permissions policies, select the newly created policy.

3. Click Next. The Name, review, and create page appears.

4. For the Role name, enter apono-k8s-access.

5. For the Description, enter required for k8s access managed by Apono.

6. Click Create role.

Authenticate the EKS cluster

Now that the IAM role has been created, you must authenticate the EKS cluster with the ConfigMap or EKS API.

Now, you can integrate with EKS.

Integrate with Elastic Kubernetes Service (EKS)

Follow these steps to complete the integration:

1. On the Catalog tab, click Elastic Kubernetes Service (EKS). The Connect Integration page appears.

2. Under Discovery, click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section appears.

2. From the dropdown menu, select a connector.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

1. Click Next. The Secret Store section expands.

1. (Optional) Associate the secret or credentials.

2. Click Next. The Get more with Apono section expands.

3. Define the Get more with Apono settings.\

   Setting

   Description

   Credential Rotation

   User cleanup after access is revoked (in days)

   (Optional) Defines the number of days after access has been revoked that the user should be deleted

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

4. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your Elastic Kubernetes Service cluster.

Log in to EKS with Apono access details

After a user gains access to an EKS resource, the user must authenticate with the cluster. The user must assume the apono-k8s-access role.

The following table shows two approaches to assume this role.

aws sts assume-role \
  --role-arn arn:aws:iam::<ACCOUNT_ID>:role/apono-k8s-access \
  --role-session-name <EMAIL> \
  --duration-seconds 3600

[profile apono-k8s-access]
role_arn = arn:aws:iam::<ACCOUNT_ID>:role/apono-k8s-access
role_session_name = <EMAIL>
source_profile = default