Focus

VM-Series Deployment Guide

IAM Permissions Required for Monitoring the AWS VPC

Table of Contents

IAM Permissions Required for Monitoring the AWS VPC

In order to enable VM Monitoring the user’s AWS login credentials tied to the AWS Access Key and Secret Access Key must have permissions for the attributes listed above. These privileges allow the firewall to initiate API calls for monitoring the virtual machines in the AWS VPC.

The IAM policy associated with the user must either have global read-only access such as AmazonEC2ReadOnlyAccess, or must include individual permissions for all of the monitored attributes. The following IAM policy example lists the permissions for initiating the API actions for monitoring the resources in the AWS VPC:

{ “Version”: “2012-10-17",
  “Statement”: [
        {
            “Sid”: “VisualEditor0”,
            “Effect”: “Allow”,
            “Action”: [
                “elasticloadbalancing:DescribeLoadBalancerAttributes”,
                “elasticloadbalancing:DescribeLoadBalancers”,
                “elasticloadbalancing:DescribeTags”,
                “ec2:DescribeInstances”,
                “ec2:DescribeNetworkInterfaces”,
                “ec2:DescribeVpcs”,
                “ec2:DescribeVpcEndpoints”,
                “ec2:DescribeSubnets”
            ],
            “Resource”: “*”
        }
    ]
}

List of Attributes Monitored on the AWS VPC

Set Up the VM-Series Firewall on KVM