Classic Onboarding

info

This page documents Classic Onboarding for AWS, reachable by selecting Switch to classic onboarding in the first step of the onboarding flow. Classic onboarding is still available for both AWS organizations and single AWS accounts. For the current flow, see Instructions.

Overview

This article walks through connecting AWS to Upwind using the classic onboarding flow in the Upwind Management Console .

Select the tab for the entity you want to connect:

• Connect AWS account: Connect a single AWS account. This flow does not require an AWS root ID or an AWS Organization ID.
• Connect AWS organization: Connect an AWS Organization and its member accounts. You designate an orchestrator account and create the required IAM roles from the management account.

Within each entity, select the tab for your deployment method, CloudFormation or Terraform.

Connect AWS account

Use this flow to connect one AWS account to Upwind. You do not need an AWS root account for this flow.

warning

Single account onboarding does not support the SaaS Cloud Scanner deployment. For AWS, SaaS Cloud Scanners are supported only through organizational onboarding. Cloud Scanners for a single account are installed in your own AWS account, as described in Install a Cloud Scanner for a single account.

CloudFormation

Generate credentials for Upwind

In Step 1 : Generate Credentials for Upwind, choose one of the following:

• In Use existing Cloud Account credentials, select credentials you already created.
• Click Generate next to Or, generate new client credentials to create new credentials.

If you stored the credentials in AWS Secrets Manager, enter the ARN in the Upwind Client Credentials ARN field instead.

Deploy and configure permissions

In Step 2 : Deploy and Configure Permissions, click Click here to log in to the AWS account you want to connect. Then click Run the AWS CloudFormation template to deploy the template in the AWS console.

Test connectivity and complete setup

After the CloudFormation stack finishes deploying, return to the Upwind Management Console and click Test & save to validate the connection and save your configuration.

Terraform

Generate credentials for Upwind

In Step 1 : Generate Credentials for Upwind, choose one of the following:

• In Use existing Cloud Account credentials, select credentials you already created.
• Click Generate next to Or, generate new client credentials to create new credentials.

If you stored the credentials in AWS Secrets Manager, enter the ARN in the Upwind Client Credentials ARN field instead.

Keep the Inject client secret into Terraform toggle enabled to include the client secret in the Terraform template.

Deploy and configure permissions using Terraform

In Step 2 : Deploy and configure permissions using Terraform setup, copy or download the Terraform template and save it as a file named main.tf. The console injects the required values into the template, so you do not need to enter them manually.

provider "aws" {
  # For detailed instructions on configuring the AWS provider, please refer to:
  # https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration
}

module "upwind_integration_aws_account" {
  source = "https://get.upwind.dev/terraform/modules/aws-account/aws-account-1.16.0.tar.gz"

  upwind_client_id              = ""
  upwind_client_secret          = ""
  upwind_organization_id        = "<organization-id>"
  upwind_auth_endpoint          = "https://auth.upwind.dev"
  upwind_integration_endpoint   = "https://integration.upwind.dev"
  upwind_trusted_account_id     = "027696145188"
}

Run Terraform apply

From the directory that contains main.tf, run the following command to establish the connection:

terraform init && terraform apply

Test connectivity and complete setup

After terraform apply completes, return to the Upwind Management Console and click Test & save to validate the connection and save your configuration.

Install a Cloud Scanner for a single account

After you connect the AWS account, you deploy a Cloud Scanner into that account. The Cloud Scanner is deployed in the AWS account and region where you run the template.

Open the Cloud Scanner setup from the Upwind Management Console, then complete the steps for your deployment method.

CloudFormation

Select a region

In Step 2 : Select a region, select the region where you want to deploy the Cloud Scanner.

Name the Cloud Scanner

In Step 3 : Cloud Scanner name, enter a name for the Cloud Scanner and click Save to create the Auto Scaling group configurations. By default, all scanning capabilities are enabled, including vulnerabilities, secrets, and malware detections. To change these settings, open the Cloud Scanner's side panel and use edit mode.

Select Cloud Scanner credentials

In Step 4 : Select Cloud Scanner Credentials, choose one of the following:

• In Use existing Cloud Scanner credentials, select credentials you already created. If you select existing credentials, you must provide the ClientSecret parameter when you launch the CloudFormation stack.
• Click Generate next to Or, generate new client credentials to create new credentials.

Log in to your AWS account

In Step 5 : Log in to your desired AWS Account, log in to the AWS account and region where you want to deploy the Cloud Scanner.

Run the CloudFormation template

In Step 6 : Run the following AWS CloudFormation template, click the template link to open the template in the AWS console. Copy the client secret and paste it into the template, then run the stack.

Test connectivity and complete setup

After the CloudFormation stack finishes deploying, return to the Upwind Management Console and click Test & save to validate the connection and save your configuration.

Terraform

Select a region

In Step 2 : Select a region, select the region where you want to deploy the Cloud Scanner. Set the region in the provider "aws" block of your Terraform template to the same region.

Name the Cloud Scanner

In Step 3 : Cloud Scanner name, enter a name for the Cloud Scanner and click Save to create the Auto Scaling group configurations. By default, all scanning capabilities are enabled, including vulnerabilities, secrets, and malware detections. To change these settings, open the Cloud Scanner's side panel and use edit mode.

Select Cloud Scanner credentials

In Step 4 : Select Cloud Scanner Credentials, choose one of the following:

• In Use existing Cloud Scanner credentials, select credentials you already created.
• Click Generate next to Or, generate new client credentials to create new credentials.

Create the Cloud Scanner Terraform template

Copy or download the following template and save it as a file named main.tf in the directory where you run Terraform. The console fills in the required values, including the scanner ID. Set the region to the region you selected in Step 2:

provider "aws" {
  # For detailed instructions on configuring the AWS provider, please refer to:
  # https://registry.terraform.io/providers/hashicorp/aws/latest/docs#authentication-and-configuration
  region = "af-south-1" # ensure this region matches your desired
}

module "upwind_integration_aws_cloudscanner" {
  source = "https://get.upwind.dev/terraform/modules/aws-cloudscanner/aws-cloudscanner-latest.tar.gz"
  max_size             = 10
  upwind_client_id     = ""
  upwind_client_secret = ""
  scanner_id           = ""
}

Run Terraform apply

From the directory that contains main.tf, run the following command to deploy the Cloud Scanner:

terraform init && terraform apply

Test connectivity and complete setup

After terraform apply completes, return to the Upwind Management Console and click Test & save to validate the connection and save your configuration.

Connect AWS organization

Use this flow to connect an AWS Organization. Start with the management account, which enables Upwind to discover the member accounts in the organization.

CloudFormation

Provide the parameters that identify your AWS Organization

In Step 1 : Provide the following parameters to identify your AWS Organization, enter the following:

1. AWS Root ID: Enter the root ID, which starts with r-. You can find it in the AWS Management Console by navigating to Organizations > Organize accounts.
2. Organization ID: Enter your AWS Organization ID.
3. Designate an Orchestrator Account: Enter the AWS account ID of the account that hosts the Upwind Cloud Scanners.

Generate credentials for Upwind

In Step 2 : Generate Credentials for Upwind, click Generate new client credentials to create the AWSScannersReportingCredentials credentials.

Create the required IAM roles

In Step 2 : Create cross-account IAM roles, complete the following:

1. Click Click here to log in to your AWS management account.
2. Keep Connect AWS Management Account enabled to connect the management account. To exclude it, disable the toggle.
3. Optionally, expand Define scanner settings to configure the scanners.
4. Click Run the AWS CloudFormation template to deploy the template in the AWS console.

Enter the role ARN from your CloudFormation stack

In Step 3 : Enter the required Role ARN from your CloudFormation stack, find the output named OrganizationServiceRoleArn in the stack. This role is usually created by the UpwindCombinedOrg stack. Paste the role ARN into the Enter role ARN field, and click Validate.

Terraform

Provide the parameters that identify your AWS Organization

In Step 1 : Provide the following parameters to identify your AWS Organization, enter the following:

1. AWS Management Account ID: Enter the 12-digit ID of the management account. You can find it in the AWS Management Console by navigating to Organizations > Settings.
2. Organization ID: Enter your AWS Organization ID.
3. Designate an Orchestrator Account: Enter the AWS account ID of the account that hosts the Upwind Cloud Scanners.

Generate credentials for Upwind

In Step 2 : Generate Credentials for Upwind, click Generate new client credentials to create the AWSOrganizationConnectionCredentials and AWSScannersReportingCredentials credentials.

Keep the Inject client secret into Terraform toggle enabled to include the client secret in the Terraform template.

Set up Terraform in the management account

Start with the management account. In Step 1 : Terraform setup, copy or download the Terraform template and save it as a file named main.tf. The console injects all of the required parameters into the template, so you do not need to enter them manually.

Optionally, expand Define scanner settings to configure the scanners before you apply the template.

Run Terraform apply

In Step 2 : Terraform apply, run the following command from the directory that contains main.tf to establish the connection:

terraform init && terraform apply

After terraform apply completes, the accounts table populates automatically.

Define the account scope

In Define account scope, choose which accounts in the organization are connected to Upwind and scanned by the Cloud Scanners. Upwind strongly recommends scanning all accounts for full protection. If you prefer more targeted coverage, you can limit scanning to specific accounts.

You can update the scope later from the settings page.