Configure authentication and permissions for AWS connectors
Before adding an AWS unified connector in DigiCert® Trust Lifecycle Manager, prepare the Amazon Web Services (AWS) credentials by selecting an authentication method and configuring the required permissions.
The way you set up authentication depends on the scope of the connector:
Organization scope: Connect to multiple accounts within an AWS organization.
Account scope: Connect to a specific AWS account.
Authentication methods
Trust Lifecycle Manager supports different methods for authenticating your Amazon Web Services (AWS) organization or account in an AWS unified connector.
Use one of the following AWS authentication methods to set up the connector in Trust Lifecycle Manager. The Configuration parameters column shows the parameters you need to provide in Trust Lifecycle Manager for each authentication method.
Authentication method | Configuration parameters | Description |
|---|---|---|
Self-authentication (Direct input) |
| Enter the AWS credentials on the connector configuration page in Trust Lifecycle Manager. |
Self-authentication (Secrets manager) |
| Use AWS credentials stored in a privileged access management (PAM) platform via a secrets manager connector:
|
Default AWS credential provider chain | — | Use the default AWS credentials on the managing DigiCert sensor, as configured in one of the following ways:
|
AWS profile name |
| Use the AWS credentials from a named profile in the local AWS config and credentials files on the managing sensor, as described in the official AWS documentation. For the Profile name parameter, enter the name of the AWS profile to use on the sensor system. |
For the Default AWS credential provider chain and AWS profile name authentication methods, the managing DigiCert sensor looks for the AWS config and credentials files in the following default directories, depending on the sensor operating system (OS):
Required permissions
AWS unified connectors require credentials for an AWS user with the following permissions, depending on whether the connector is configured for organization scope or account scope. For organization scope, you can use either the management account or a member account for authentication.
To use the management account to authenticate an AWS unified connector with organization scope:
Make sure the AWS Account Management service is enabled for the AWS organization.
Create a user in the management account for the AWS organization, using one of the following methods to apply permissions.
To use a member (non-management) account to authenticate an AWS unified connector with organization scope:
Make sure the AWS Account Management service is enabled for the AWS organization.
Follow the steps below to create a user in the member account and set up the required roles in the management account and child accounts.
Step 1: Create user in the member account
Create a user in the member account to use for authentication, using one of the following methods to apply permissions.
Step 2: Create custom role in the management account
Create a custom role (for example, CrossAccountAccess) in the management account, with the following properties:
Trusts the user account created in step 1.
Includes the
AWSOrganizationReadOnlypermission.(Optional) To discover certificates in the management account, also includes the
AWSCertificateManagerFullAccesspermission.
Step 3: Create custom role in all child accounts
Create a custom role in all the child accounts to manage through the connector, with the following properties:
Same name as the custom role created in the management account in step 2.
Trusts the user account created in step 1.
Includes one of the following permission sets:
To authenticate an AWS unified connector with account scope, create an IAM user in the AWS account and use one of the following methods to apply permissions.
What's next
After setting up the AWS credentials to use for authentication, you're ready to add an AWS unified connector in Trust Lifecycle Manager.