Cloud Risk Configuration - Amazon Web Service

How to configure in ADAudit Plus:

Go to Azure AD tab, then Threat sub-tab, you will be navigated to Cloud Directory page. Click on Add Cloud Directory
Select AWS Cloud
Enter the Display name, Account Number, Access Key ID and Secret Access Key
Select the Audit Log checkbox if you want to fetch and monitor all the operations performed in your AWS environment
Click on Next
Review your configuration and click on Finish

How to get client ID and client secret for configuring in ADAudit Plus:

Configure via IAM Console

Go to IAM console https://console.aws.amazon.com/iam
In the IAM dashboard, click on Policies then click the Create policy button.
In the policy editor page, select the JSON mode and paste the below permission statement and click Next.

            
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "ServicePermissions0",
			"Effect": "Allow",
			"Action": [
				"autoscaling:DescribeAutoScalingGroups",
				"autoscaling:DescribeLaunchConfigurations",
				"autoscaling:DescribeNotificationConfigurations",
				"cloudfront:GetDistribution",
				"cloudfront:ListDistributions",
				"cloudtrail:DescribeTrails",
				"cloudtrail:GetEventSelectors",
				"cloudtrail:GetTrailStatus",
				"cloudtrail:ListTags",
				"cloudtrail:LookupEvents",
				"cloudwatch:DescribeAlarms",
				"codebuild:BatchGetProjects",
				"codebuild:ListProjects",
				"config:DescribeComplianceByConfigRule",
				"config:DescribeConfigRules",
				"config:DescribeConfigurationRecorders",
				"config:DescribeConfigurationRecorderStatus",
				"config:DescribeDeliveryChannels",
				"config:GetComplianceDetailsByConfigRule",
				"config:GetDiscoveredResourceCounts",
				"dax:DescribeClusters",
				"dynamodb:DescribeContinuousBackups",
				"dynamodb:DescribeTable",
				"dynamodb:ListBackups",
				"dynamodb:ListTables",
				"dynamodb:ListTagsOfResource",
				"ec2:DescribeAccountAttributes",
				"ec2:DescribeAddresses",
				"ec2:DescribeAvailabilityZones",
				"ec2:DescribeCustomerGateways",
				"ec2:DescribeDhcpOptions",
				"ec2:DescribeEgressOnlyInternetGateways",
				"ec2:DescribeImages",
				"ec2:DescribeInstances",
				"ec2:DescribeInstanceStatus",
				"ec2:DescribeInternetGateways",
				"ec2:DescribeFlowLogs",
				"ec2:DescribeKeyPairs",
				"ec2:DescribeLaunchTemplates",
				"ec2:DescribeManagedPrefixLists",
				"ec2:DescribeNatGateways",
				"ec2:DescribeNetworkAcls",
				"ec2:DescribeNetworkInterfaces",
				"ec2:DescribeRegions",
				"ec2:DescribeRouteTables",
				"ec2:DescribeSecurityGroupRules",
				"ec2:DescribeSecurityGroups",
				"ec2:DescribeSnapshotAttribute",
				"ec2:DescribeSnapshots",
				"ec2:DescribeSubnets",
				"ec2:DescribeVolumes",
				"ec2:DescribeVpcEndpoints",
				"ec2:DescribeVpcEndpointServicePermissions",
				"ec2:DescribeVpcEndpointServices",
				"ec2:DescribeVpcPeeringConnections",
				"ec2:DescribeVpcs",
				"ec2:DescribeVpnConnections",
				"ec2:DescribeVpnGateways",
				"ec2:GetEbsEncryptionByDefault",
				"ec2:GetManagedPrefixListEntries",
				"elasticache:DescribeCacheClusters",
				"elasticache:DescribeCacheSubnetGroups",
				"elasticache:DescribeReplicationGroups",
				"elasticache:DescribeReservedCacheNodes",
				"elasticache:DescribeSnapshots",
				"elasticache:ListTagsForResource",
				"elasticbeanstalk:DescribeApplications",
				"elasticbeanstalk:DescribeConfigurationSettings",
				"elasticbeanstalk:DescribeEnvironments",
				"elasticfilesystem:DescribeBackupPolicy",
				"elasticfilesystem:DescribeFileSystems",
				"elasticloadbalancing:DescribeListeners",
				"elasticloadbalancing:DescribeLoadBalancerAttributes",
				"elasticloadbalancing:DescribeLoadBalancerPolicies",
				"elasticloadbalancing:DescribeLoadBalancers",
				"elasticloadbalancing:DescribeTags",
				"elasticloadbalancing:DescribeTargetGroupAttributes",
				"elasticloadbalancing:DescribeTargetGroups",
				"elasticloadbalancing:DescribeTargetHealth",
				"iam:GenerateCredentialReport",
				"iam:GetAccountPasswordPolicy",
				"iam:GetCredentialReport",
				"iam:GetGroup",
				"iam:GetGroupPolicy",
				"iam:GetPolicyVersion",
				"iam:GetRole",
				"iam:GetRolePolicy",
				"iam:GetUserPolicy",
				"iam:ListAttachedGroupPolicies",
				"iam:ListAttachedRolePolicies",
				"iam:ListAttachedUserPolicies",
				"iam:ListGroupPolicies",
				"iam:ListGroups",
				"iam:ListPolicies",
				"iam:ListRolePolicies",
				"iam:ListRoles",
				"iam:ListRoleTags",
				"iam:ListServerCertificates",
				"iam:ListSSHPublicKeys",
				"iam:ListUserPolicies",
				"iam:ListUsers",
				"iam:ListUserTags",
				"iam:ListVirtualMFADevices",
				"kms:DescribeKey",
				"kms:GetKeyPolicy",
				"kms:GetKeyRotationStatus",
				"kms:ListAliases",
				"kms:ListGrants",
				"kms:ListKeys",
				"kms:ListResourceTags",
				"lambda:GetPolicy",
				"lambda:ListFunctions",
				"lambda:ListFunctionUrlConfigs",
				"lambda:ListTags",
				"logs:DescribeLogGroups",
				"logs:DescribeLogStreams",
				"logs:GetLogEvents",
				"logs:Unmask",
				"logs:DescribeMetricFilters",
				"memorydb:DescribeClusters",
				"memorydb:DescribeSubnetGroups",
				"rds:DescribeDBClusterParameterGroups",
				"rds:DescribeDBClusterParameters",
				"rds:DescribeDBClusters",
				"rds:DescribeDBEngineVersions",
				"rds:DescribeDBInstances",
				"rds:DescribeDBParameterGroups",
				"rds:DescribeDBParameters",
				"rds:DescribeDBSnapshotAttributes",
				"rds:DescribeDBSnapshots",
				"rds:DescribeEventSubscriptions",
				"route53:ListHostedZones",
				"route53:ListResourceRecordSets",
				"route53domains:GetDomainDetail",
				"route53domains:ListDomains",
				"s3:GetAccelerateConfiguration",
				"s3:GetAccountPublicAccessBlock",
				"s3:GetBucketAcl",
				"s3:GetBucketLocation",
				"s3:GetBucketLogging",
				"s3:GetBucketObjectLockConfiguration",
				"s3:GetBucketOwnershipControls",
				"s3:GetBucketPolicy",
				"s3:GetBucketPolicyStatus",
				"s3:GetBucketPublicAccessBlock",
				"s3:GetBucketTagging",
				"s3:GetBucketVersioning",
				"s3:GetBucketWebsite",
				"s3:GetEncryptionConfiguration",
				"s3:GetLifecycleConfiguration",
				"s3:GetObject",
				"s3:GetObjectAcl",
				"s3:GetObjectVersion",
				"s3:GetObjectVersionAcl",
				"s3:ListAllMyBuckets",
				"s3:ListBucket",
				"sns:GetTopicAttributes",
				"sns:ListSubscriptions",
				"sns:ListTagsForResource",
				"sns:ListTopics",
				"sqs:GetQueueAttributes",
				"sqs:ListQueues",
				"waf-regional:ListResourcesForWebACL",
				"waf-regional:ListWebACLs",
				"waf:ListWebACLs",
				"wafv2:GetWebACL",
				"wafv2:ListResourcesForWebACL",
				"wafv2:ListWebACLs"
			],
			"Resource": "*"
		}
	]
}

Enter the name for your policy and description, you can review the permission required by servies then click Create Policy button.
You will be redirected to IAM policies page on completion.
To create User select Users in left navigation-pane and click on Create user button.
Enter the username and click next.
In Permissions options select Attach policies directly then select the policy you created and click Next
Review your choices and click on Create User.

Getting Access Key and Secret

After creating the user and attaching the policy to it, open that User's detils page.
Click on Security credentials and click Create Access Key.
Select Other option and Next.
Enter description for this key.
You will receive your Access Key and Secret Key. Use this to configure in ADAudit Plus.

Activity log: Fetches and shows all the Operations performed on the Cloud Account Services

ManageEngine