What permissions are required to scan my AWS environment?

Holm Security Cloud Scanner for Amazon Web Services (AWS)

Cloud Provider Configuration

Create a "Holm Security Cloud Scanner" user with the SecurityAudit policy.

1. Log into your AWS account as an admin or with permission to create IAM resources.
2. Navigate to the IAM console.
3. Click on Users.
4. Create a new user (Add user).
5. Set the username to "Holm cloud scanner".
6. Set the access type to "Programmatic access" and click Next.
7. Select Attach existing policies directly and select the SecurityAudit policy.
8. Click Create policy to create a supplemental policy (some permissions are not included in SecurityAudit).
9. Click the JSON tab and paste the following permission set.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ses:DescribeActiveReceiptRuleSet",
                   "athena:GetWorkGroup",
                   "logs:DescribeLogGroups",
                   "logs:DescribeMetricFilters",
                   "elastictranscoder:ListPipelines",
                   "elasticfilesystem:DescribeFileSystems",
                   "servicequotas:ListServiceQuotas"
               ],
               "Resource": "*"
           }
       ]
   }

10. Click Review policy.
11. Provide a name (HolmCloudSupplemental) and click Create policy.
12. Return to the Create user page and attach the newly-created policy. Click Next: tags.
13. Set tags as needed and click Create user.
14. Make sure you safely store the Access key ID and Secret access key.
15. Paste them into the corresponding AWS credentials section of the Security Center cloud scan configuration.
16. Done!