Skip to main content

Connecting Your AWS Organization

Connect an AWS Organization or OU with a StackSet.

This article shows you how to connect every account in an AWS Organization, or in a specific Organizational Unit (OU), to Cye Cloud Posture Solution by deploying a CloudFormation StackSet from your organization's master account.

Overview

Cye Cloud Posture Solution, the Cloud Security Posture Management (CSPM) component of the Cye platform, scans each AWS account through a read-only IAM role created by a CloudFormation stack. A StackSet deploys that stack to all the accounts in your organization or OU in one operation, so you do not have to connect each child account by hand.

  • Connect the Master Account First: Connect the organization master account the same way as a single account, then use it to deploy the StackSet to the child accounts.

  • Deploy with Service-Managed Permissions: The integration StackSet uses the service-managed permission model so CloudFormation can create stack instances in the target organization or OUs.

  • Confirm in the Console: The onboarded accounts appear on the accounts page several minutes after the StackSet completes.

1. Connect the organization master account

The child accounts are connected from the master account, so the master account has to be connected first.

  1. Go to the AWS console and log in to your organization master account.

  2. Follow Connecting Your AWS Account to connect the master account to Cye Cloud Posture Solution.

2. Open StackSets in CloudFormation

After the master account is connected successfully, you can connect all the child accounts.

  1. In the AWS console, go to the CloudFormation service.

  2. Click StackSets.

3. Create the StackSet

The integration StackSet uses the service-managed permission model to deploy stack instances in the target organization or OUs. When prompted, enable the use of service-managed permissions.

  1. Click Create StackSet.

  2. In Amazon S3 URL, enter https://s3.us-east-1.amazonaws.com/solvo-cft-prod/onboarding-cft-rw.json and click Next.

  3. Enter the following values:

    • Stack name: solvo-integration-stackset

    • ExternalId: Your tenant ID, as supplied by the support team.

    • RoleSuffix: Any random 15-character string of letters and numbers.

    • SolvoAWSAccount: 844333365856

    • SolvoSnsTopic: prod-onboarding-cft-completed

  4. Click Next.

  5. Click Next again.

  6. Select whether to deploy the stack to all accounts in the organization or to a specific OU.

  7. Specify the US East region.

  8. Click Next.

  9. Select I acknowledge that AWS CloudFormation might create IAM resources with custom names and click Submit.

4. Confirm the accounts are connected

The connection is established a few minutes after the StackSet finishes.

  1. Wait for the StackSet to complete.

  2. Log in to the console at console.solvo.cloud.

  3. Allow several minutes for the connection to be established. After a successful connection, the onboarded AWS accounts appear on the accounts page.

Wrap-up / Next Steps

Related Articles
Did this answer your question?