AWS IAM

To sync AWS IAM users with the Anomali Agentic SOC Operations for identity management, you must first configure the AWS IAM integration on the Integrations Marketplace page. For details on identity management within the Anomali Agentic SOC Operations, see Identities.

Before You Begin

Before configuring the AWS IAM integration with the Anomali Agentic SOC Operations, set up an IAM identity in your AWS account with the required permissions, and gather the credentials Anomali needs to connect.

  1. Create an IAM user or IAM role and grant them the following permissions:

    Permission Purpose
    iam:ListUsers List IAM users.
    iam:ListUserTags Read user tags. Required if Fetch Tags is enabled. See Configuring the AWS IAM Integration.
    iam:ListGroups List IAM groups.
    iam:GetGroup Read group members.
    sts:GetCallerIdentity Resolve the AWS account ID automatically.

    For cross-account access, create a role with the above permissions and note its Role ARN.

    For details on IAM user creation, refer to Create an IAM user in your AWS account.

    For details on IAM role creation, refer to Creating an IAM role.

  2. If you created an IAM user, create also an access key for it in the IAM console, and then save the access key ID and secret access key. For details, see How an IAM administrator can manage IAM user access keys.

Configuring the AWS IAM Integration

To configure the AWS IAM integration:

  1. Navigate to ThreatStream Next Gen > Integrations Marketplace > Entity Sources.

  2. Click the three-dot vertical menu on the AWS IAM tile and then click Configure.

    Alternatively, click the AWS IAM tile and then click Connect.

  3. On the Configure AWS IAM page that opens, enter the following details:

    Field Name Description
    Name Name the integration.
    Description (Optional) Description for the integration.
    Credentials
    Access Key ID

    AWS IAM access key ID.
    AWS Region AWS region for API calls. Default: us-east-1.
    Role ARN (cross-acount) (Optional) ARN of an IAM role. Use for cross-account access.
    Secret Access Key

    IAM secret access key.
    Sync Configuration
    Batch Size Number of identity records written per database operation. Default: 500.
    Note: Anomali recommends keeping the default batch size value unless you experience memory issues. Large values reduce database round trips but consume more memory.
    Fetch IAM Tags When selected, reads IAM user tags to enrich identity attributes. For example, email, display name, department, job title, and so on.
    Users Per Page Users fetched per paginated IAM API request. Default: 100.
    Field Mapping Field mappings let you override which source attribute is used for each canonical identity field. This is useful when your directory uses non-standard attribute names or you want to prefer a specific field over the default.
    Display Name Source attribute to use as the user's display name.
    Email/Hostname Source attribute to use as the primary identity key.
    Source ID Source attribute to use as the stable internal identity ID.
    Sync Settings
    Sync Frequency Interval for incremental syncs. Default: Hourly.

  4. Click Create.

The AWS IAM integration is activated. Confirm that the integration status shows Active and health shows Healthy.

On the integration details page, you can view the integration status, health, the date and time of the last synchronization with the source, the synchronization schedule, and the number of identities discovered in the configuration. On this page, you can also force sync, edit, deactivate, and delete the integration configuration. For details, see Managing Integrations.