Ctrlk
Book a demo
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AWS Organization Connection

Use this method to connect multiple AWS accounts managed through AWS Organizations.

The CloudFormation deployment creates the required IAM roles across your organization, allowing OX to analyze cloud security findings across all connected AWS accounts.

After completing the deployment, connect the AWS Organizations integration in OX using the AWS Role ARN generated for the management account.

Before you begin

Deploy the CloudFormation StackSet to:

  • The AWS Organizations management account

  • All existing member accounts

Use the same values for the following settings across all accounts:

Setting
Value

External ID

Same value for all accounts

IAM role name

Same value for all accounts

Configure AWS credentials separately for each account during deployment.

Step 1: Deploy the StackSet [AWS]

  1. Sign in to the AWS Management Console.

  2. Open CloudFormation.

  3. Select StackSets.

  4. Select Create StackSet.

Choose a template

Configure the template using the following values.

Setting
Value

Permissions

Service-managed permissions

Prerequisite – Prepare template

Template is ready

Specify template

Amazon S3 URL

Amazon S3 URL

https://ox-cloudformation-template.s3.eu-west-1.amazonaws.com/aws/ox_aws_integration_stackset_template_k8s.yml

  1. Select Next.

Specify StackSet details

Configure the StackSet using the following values.

Setting
Value

StackSet name

ox-security (must be unique)

Description

Optional

External ID

External ID generated in the OX AWS connector

IAMRoleName

Leave the default value

OxAWSAccountId

Leave the default value

  1. Select Next.

Configure StackSet options

Configure the following setting.

Setting
Value

Managed execution

Inactive

  1. Select Next.

Set deployment options

Configure the deployment using the following values.

Setting
Value

Add stacks to stack set

Deploy new stacks

Deployment targets

Deploy to organization

Automatic deployment

Enabled

Account removal behavior

Delete stacks

Region

Select one AWS region

Maximum concurrent accounts

1

Failure tolerance

0

Region concurrency

Sequential

  1. Select Next.

  2. Review the configuration.

  3. Under Capabilities, select the acknowledgment checkbox.

  4. Select Submit.

  5. Wait for the StackSet deployment to complete.

Note

Select only one AWS region. Selecting multiple regions causes the deployment to fail.

Step 2: Deploy the CloudFormation stack [AWS]

  1. In OX, on the AWS connector page, select CloudFormation Assume Role.

  2. On the Create stack page:

    1. Select the acknowledgment checkbox.

    2. Select Create stack.

  3. Wait for the deployment to complete.

  4. Open the Outputs tab.

  5. Copy the OxRoleArn value.

Note

If a CloudFormation stack named ox-security already exists, specify a different stack name. Otherwise, the deployment fails because the stack name must be unique.

Step 3: Connect AWS [OX]

  1. In OX, go to Settings > Connectors.

  2. Select AWS.

  3. In the AWS Role ARN field, paste the OxRoleArn value generated by the management account deployment.

  4. Select Connect.

Verify that the connector status changes to Connected.

Last updated