Skip to main content

AWS Control Tower Integration Using CloudFormation

Overview​

With Lacework and AWS Control Tower, enrolling a new AWS account now means security best practices and monitoring are automatically applied consistently across your organization. Account administrators can automatically add Lacework's security auditing and monitoring to AWS accounts seamlessly. All the required Lacework and AWS account configurations that allow access to AWS configuration and CloudTrail logs are managed for you by Lacework’s AWS Control Tower integration.

How It Works​

The Lacework AWS Control Tower integration audits and monitors AWS accounts in your AWS Control Tower Landing Zone. Your Landing Zone is your multi-account environment for which you can apply your governance, auditing and monitoring. On initial setup, the Lacework AWS Control Tower integration creates a new cross-account role in the Log Archive account and a new SQS queue is set up in the Audit account. The SQS queue allows Lacework to receive notifications of new audit logs in S3 from the centralized CloudTrail that collects activity from all accounts. Lacework processes these logs for behavior analysis for all AWS accounts.

For new AWS accounts in your organization, AWS Control Tower Account Factory enables easy onboarding of new and existing AWS accounts which triggers the Lacework integration through a new account lifecycle event. A Lambda function launches a stack instance that creates a new cross-account role and allows Lacework to monitor the account via AWS APIs. The combination of CloudTrail log analysis and AWS API access allows Lacework to check your cloud activity and AWS configuration to detect security misconfigurations and anomalous behavior.

Prerequisites​

You need the following prerequisites to implement the Lacework AWS Control Tower integration.

Deployment Scenarios​

1. Without Lacework Organization​

If the Lacework Organization feature is not enabled, all AWS accounts will go under the main Lacework account by default. Leave the Single Sub-Account Configuration and Organization Configuration sections blank in the CloudFormation stack parameters.

2. Single Lacework Sub-Account with Lacework Organization​

If the Lacework Organization feature is enabled, you can specify a Lacework sub-account for which all AWS accounts will be added. This is specified in the Single Sub-Account Configuration section in the Lacework Sub-Account Name field (see below) in the CloudFormation stack parameters.

3. AWS Organizations to Lacework Sub-Account Mapping with Lacework Organization​

If the Lacework Organization feature is enabled, you can specify a comma-separated list of AWS organization names that match Lacework sub-account names. AWS accounts will be added to the appropriate Lacework sub-accounts based on this AWS organization-to-Lacework sub-account name mapping. AWS organization names and Lacework sub-account names must match. AWS accounts not in the specified organizations will not be added to Lacework. This is specified in the Organization Configuration section in the AWS Organizations to Lacework Sub-Account Names field (see below) in the CloudFormation stack parameters.

When creating AWS organizations, creating AWS accounts or moving AWS accounts across organizations, ensure that you use the recommended AWS Control Tower methods. This will ensure that Lacework monitors the correct AWS accounts. Making updates to AWS accounts outside of AWS Control Tower may cause issues.

Installing the Lacework AWS Control Tower Integration​

1. Generate a Lacework API Access Key​

  1. In your console, go to Settings > Configuration > API keys.
  2. Click on the + Add New button in the upper right to create a new API key.
  3. Provide a name and description and click Save.
  4. Click the download button to download the API keys file.
  5. Copy the keyId and secret from this file.

2. Login into your AWS Control Tower Management Account​

  1. Login in to AWS Control Tower management account.
  2. Select the AWS region where your AWS Control Tower is deployed.

3. Deploy the Lacework AWS Control Tower Integration with CloudFormation​

  1. Click on the following Launch Stack button to go to your CloudFormation console and launch the AWS Control Integration template.

    For most deployments, you only need the Basic Configuration parameters.

  2. Specify the following Basic Configuration parameters:

    • Enter a Stack name for the stack.

    • Enter Your Lacework URL.

    • Enter your Lacework Access Key ID and Secret Key that you copied from your previous API Keys file.

    • For Capability Type, the recommendation is to use CloudTrail+Config for the best capabilities.

    • Choose whether you want to Monitor Existing Accounts. This will set up monitoring of ACTIVE existing AWS accounts.

    • Enter the name of your Existing AWS Control Tower CloudTrail Name.

    • If your CloudTrail S3 logs are encrypted, specify the KMS Key Identifier ARN. Ensure that KMS Key Policy is updated to allow access to the Log account cross-account role used by Lacework. Add the following to the Key Policy.

      "Sid": "Allow Lacework to decrypt logs",
      "Effect": "Allow",
      "Principal": {
      "AWS": [
      "arn:aws:iam::<log-archive-account-id>:role/<lacework-account-name>-laceworkcwssarole"
      ]
      },
      "Action": [
      "kms:Decrypt"
      ],
      "Resource": "*"

    • Update the Control Tower Log Account Name and Audit Account Name if necessary.

    • If using AWS organizations to Lacework sub-account mapping, specify a comma-separated lists of organization names in the Organization Configuration section in the AWS Organizations to Lacework Sub-Account Names field. AWS accounts will be added to the appropriate Lacework sub-accounts based on this AWS organization-to-Lacework sub-account name mapping. AWS organization names and Lacework sub-account names must match. AWS accounts not in the specified organizations will not be added to Lacework.

    • If using a single Lacework sub-account for all AWS accounts, specify a Lacework sub-account for which all AWS accounts will be added. This is specified in the Single Sub-Account Configuration section in the Lacework Sub-Account Name field.

  3. Click Next through to your stack Review.

  4. Accept the AWS CloudFormation terms and click Create stack.

4. CloudFormation Progress​

  1. Monitor the progress of the CloudFormation deployment. It takes several minutes for the stack to create the resources that enable the Lacework AWS Control Tower Integration.
  2. When successfully completed, the stack shows CREATE_COMPLETE.

5. Validate the Lacework AWS Control Tower Integration​

  1. Login to your Lacework Cloud Security Platform console.
  2. Go to Settings > Integration > Cloud Accounts.
  3. You should see a list of AWS accounts that are now being monitored by Lacework. The Cloud Account column values correspond to the AWS Account IDs.

Remove the Lacework AWS Control Tower Integration​

To remove the Lacework AWS Control Tower Integration, simply delete the main stack. All CloudFormation stacksets, stack instances, and Lambda functions will be deleted.

note

Lacework will no longer monitor your AWS cloud environment.

Troubleshooting​

The following sections provide guidance for resolving issues with deploying the Lacework AWS Control Tower integration.

Common Issues​

  • Ensure the Existing AWS Control Tower CloudTrail Name is correct. You can verify this on your AWS CloudTrail Dashboard.

  • Ensure that your Log Archive and Audit account names are correct and these accounts are ACTIVE.

  • If you are using the Lacework Organization feature to manage your accounts, specify the correct sub-account name, API key ID and secret key.

  • If Lacework returns a S3 access error for the CloudTrail account and a KMS key is used, ensure that KMS Key Policy is updated to allow access to the Log account cross-account role used by Lacework.

    "Sid": "Allow Lacework to decrypt logs",
    "Effect": "Allow",
    "Principal": {
        "AWS": [
            "arn:aws:iam::<log-archive-account-id>:role/<lacework-account-name>-laceworkcwssarole"
        ]
    },
    "Action": [
        "kms:Decrypt"
    ],
    "Resource": "*"

Events and Logs​

CloudFormation Events​

You can monitor the CloudFormation events for the Lacework AWS Control Tower integration stack. Events may reveal issues with resource creation. The Lacework AWS Control Tower integration stack launches a main stack and three stacksets:

Main Deployment Stack:

  • control-tower-integration.template.yml - Main stack that deploys all resources: IAM roles, access token credentials, IAM roles, SQS queues, Lambda functions and the stacksets below.

Centralized CloudTrail Cloud Account in Lacework: (Applied once during initial deployment)

  • lacework-aws-ct-audit.template.yml -> Lacework-Control-Tower-CloudTrail-Audit-Account-Lacework account - Creates a stack instance in the Audit account.
  • lacework-aws-ct-log.template.yml -> Lacework-Control-Tower-CloudTrail-Log-Account-Lacework account - Creates a stack instance in the Log account.

Config Cloud Account in Lacework: (Applied for each AWS account)

  • lacework-aws-cfg-member.template.yml -> Lacework-Control-Tower-Config-Member-Lacework account - Creates a stack instance in each AWS account.

Examining these stacksets for operation results, stack instance results and parameters may also provide debug information.

Lambda Function CloudWatch Logs​

Two main Lambda functions are used to manage accounts. LaceworkSetupFunction manages the initial deployment of the integration. LaceworkAccountFunction manages setting up existing and new accounts. Both Lambda functions provide extensive debug messages that can be seen in their respective CloudWatch log streams.

FAQs​

  • Can I individually choose which accounts are added to Lacework within AWS Control Tower?

    Yes, if you have the Lacework Organization feature enabled. You can choose which AWS accounts are added by specifying the AWS organizations. This requires Lacework sub-accounts to be named the same as your AWS organizations in order to map AWS accounts accordingly. AWS organizations that are not specified will not have their AWS accounts added to Lacework.

  • How does Lacework integrate with AWS Control Tower's CloudTrail?

    With AWS Control Tower, a centralized AWS CloudTrail trail is used. All cloud user and API activity are logged to this single trail. Lacework monitors all cloud activity from this trail.