Skip to main content

GovCloud

Secure your government workloads with JupiterOne's AWS GovCloud integration. Our guide walks you through the installation process and showcases the integration's data model, providing you with comprehensive visibility into your GovCloud environment. Learn how AWS GovCloud integration can help you monitor and manage your security posture, ensuring that you meet government security and compliance requirements

Installation​

To install this integration, you will need to configure settings both within AWS GovCloud and on JupiterOne. Unlike the commercial AWS integration, which assumes an IAM role, the GovCloud integration authenticates with the Access Key ID and Secret Access Key of a dedicated IAM user, along with the Account ID of the GovCloud account to synchronize.

Information is ingested from the AWS GovCloud regions us-gov-east-1 and us-gov-west-1. A small number of AWS services are only offered in us-gov-west-1, and are ingested from that region only.

info

The GovCloud integration runs the same ingestion code as the commercial AWS integration, so it produces the same entities and relationships. See the Data Model and Types tabs for the full list. Resource ARNs use the aws-us-gov partition.

Configuration in AWS GovCloud​

JupiterOne maintains the IAM policy, the CloudFormation template, and the Terraform for GovCloud in the public JupiterOne AWS CloudFormation project on GitHub. Use one of the three options below. CloudFormation is recommended, because the permission set is kept up to date there as the integration adds coverage for new services.

  1. Download the latest GovCloud CloudFormation template: iam-cloudformation-govcloud.json.
  2. In the AWS GovCloud Console, go to CloudFormation and select Stacks.
  3. Select Create stack, then With new resources (standard).
  4. Select Template is ready and Upload a template file, upload the file you downloaded, and click Next.
  5. Enter JupiterOneAccess as the stack name, then click Next.
  6. On the Review and create page, accept the checkbox labeled I acknowledge that AWS CloudFormation might create IAM resources with custom names. JupiterOne uses this permission to create the JupiterOneSecurityAudit managed policy; you can review the exact permissions it grants in managed-policy.md.
  7. Click Submit.

The stack creates an IAM user named JupiterOneAccessUser with the AWS-managed SecurityAudit policy and the JupiterOneSecurityAudit policy attached. Continue to Create an access key.

Option 2: Terraform​

  1. Download the latest GovCloud Terraform: terraform.tf.
  2. Apply it in each AWS GovCloud account you want to ingest.

The Terraform creates an IAM user named jupiterone-access-user with the same two policies attached. Continue to Create an access key.

Option 3: Manual configuration​

  1. From the AWS GovCloud Console, search for and select IAM under Services.
  2. Select Policies, click Create policy, and select the JSON tab.
  3. Paste the policy document from managed-policy.md. This is the same document deployed by the CloudFormation template and is the authoritative permission set.
  4. Click Next, enter JupiterOneSecurityAudit as the name, and click Create policy.
  5. Go to Users and select Create user. Enter JupiterOneAccessUser as the user name.
  6. On the permissions step, select Attach policies directly and select both SecurityAudit (the AWS-managed policy) and the JupiterOneSecurityAudit policy you just created.
  7. Click Next, review the user information, and click Create user.
caution

Keep the manually created policy in sync with managed-policy.md. A policy that drifts behind the maintained one causes individual ingestion steps to fail with access-denied errors as the integration adds coverage for new services.

Create an access key​

  1. In the IAM console, open the user created above (JupiterOneAccessUser for CloudFormation and manual setups, jupiterone-access-user for Terraform).
  2. Select the Security credentials tab.
  3. Under Access keys, click Create access key.
  4. Select Other, then create the access key.
  5. Copy both the Access key ID and the Secret access key (click Show to display it). These values are needed for the JupiterOne configuration and the secret cannot be retrieved again after you leave this page.

Set Permissions​

The GovCloud integration requires security auditor permissions in the target AWS GovCloud account, defined by the combination of the AWS-managed SecurityAudit policy and the additional List*, Get*, and Describe* permissions that SecurityAudit does not cover. The exact policy and permission statements are maintained in the public JupiterOne AWS CloudFormation project.

For the permissions required by each individual ingestion source, see the Authorization tab.

Configuration in JupiterOne​

  1. From the top navigation of the J1 Search homepage, select Integrations.
  2. Scroll to the GovCloud integration tile and click it.
  3. Click New instance and configure the following settings:
    • The Account Name used to identify this AWS GovCloud account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.
    • A Description to assist in identifying the integration instance, if desired.
    • A Polling Interval that fits your monitoring needs. You may leave this as DISABLED and manually execute the integration.
    • The Account ID of the AWS GovCloud account you are ingesting data from.
    • The Access Key ID of the IAM user created above.
    • The Secret Access Key associated with the Access Key ID.
  4. Click Create Configuration after all values are provided.

Service Control Policy Issues​

Errors may occur if a Service Control Policy (SCP) is blocking specified services or regions. AWS services that JupiterOne cannot ingest are listed in the Integration Jobs logs (Integrations > Configurations > Settings > Jobs).

For each SCP that is blocking JupiterOne ingestion, add the following condition to your SCP JSON. Note the aws-us-gov partition in the ARN:

"Condition": {
  "ArnNotLike": {
    "aws:PrincipalARN": [
        "arn:aws-us-gov:iam::*:user/JupiterOne*",
        "arn:aws-us-gov:iam::*:user/jupiterone*"
    ]
  }
}

Ensure these ARNs match the IAM user used to configure your JupiterOne GovCloud integration.

info

See the AWS Service control policies documentation for the latest information.

Differences from the commercial AWS integration​

Both integrations ingest the same entity types, but the GovCloud integration instance offers a smaller set of configuration options:

CapabilityAWSGovCloud
AuthenticationRole ARN with an External ID, optionally chained through an intermediate roleAccount ID with an IAM user Access Key ID and Secret Access Key
RegionsAll AWS regions that do not require additional contractual arrangements with AWSus-gov-east-1 and us-gov-west-1
ARN partitionawsaws-us-gov
Organization account managementSupported. Sub-account instances are created and managed automatically.Not supported. Configure one integration instance per GovCloud account.
Ingestion window and data filtering optionsConfigurable per instance (ECR, Inspector V2, and Security Hub findings)Not configurable. Defaults apply.
Ingestion sourcesIndividually toggleableIndividually toggleable

Reference​

S3 Bucket public Property​

The aws_s3_bucket.public property is calculated based on the Access field in the AWS S3 console:

Accessaws_s3_bucket.public
Publictrue
Objects can be publicundefined
Bucket and objects not publicfalse

AWS IAM Policies​

Each aws_iam_policy entity includes a boolean admin property that indicates whether the policy grants administrative-level access. The flag is determined from the policy name: if the name contains the word "admin" (case-insensitive), the flag is set to true. Examples: AdministratorAccess, AdminPolicy, MyCustomAdminRole.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. See the Instance management guide to learn more about working with and editing integration instances.