# AWS Cloud Security Posture Management (CSPM)
Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fsecurity%2Fcloud-security-posture-management%2Faws-cloud-security-posture-management.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fuser-guides%2Fsecurity%2Fcloud-security-posture-management%2Faws-cloud-security-posture-management.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)
Cloud Security Posture Management (CSPM) helps to mitigate and minimize cloud data security breaches and to assess the overall posture of the entire cloud environment against best practices and compliance standards to help remediate issues.
CSPM tools verify that cloud configurations follow security best practices and compliance standards such as CIS, Azure, and GCP benchmarks as well as PCI and HIPAA frameworks. As companies are increasingly moving to the cloud, CSPM is becoming a necessary aspect of security insights.
## API keys[](#api-keys "Direct link to API keys")
To use these tools you need to create the following API keys:
1. [Send-Your-Data API Key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/send-your-data-api-key/.md)
2. (Optional) A personal or team [API key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/api-keys/.md). It’s recommended to use permission presets, as they are automatically updated with all relevant permissions. Alternatively, you can manually add individual permissions.
| Preset | Action | Description |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Enrichments | `CLOUD-METADATA-ENRICHMENT:READCONFIG`
`CLOUD-METADATA-ENRICHMENT:UPDATECONFIG`
`GEO-ENRICHMENT:READCONFIG`
`GEO-ENRICHMENT:UPDATECONFIG`
`SECURITY-ENRICHMENT:READCONFIG`
`SECURITY-ENRICHMENT:UPDATECONFIG`
`TEAM-CUSTOM-ENRICHMENT:READCONFIG`
`TEAM-CUSTOM-ENRICHMENT:READDATA`
`TEAM-CUSTOM-ENRICHMENT:UPDATECONFIG`
`TEAM-CUSTOM-ENRICHMENT:UPDATEDATA` | View AWS Enrichment Configuration
Manage AWS Enrichment Configuration
View Geo Enrichment Configuration
Manage Geo Enrichment Configuration
View Unified Threat Intelligence Enrichment Configuration
Manage Unified Threat Intelligence Enrichment Configuration
View Custom Enrichment Configuration
View Custom Enrichment Data
Manage Custom Enrichment Configuration
Manage Data for Custom Enrichment Ingestion |
## Installation[](#installation "Direct link to Installation")
The CSPM can be installed using the following methods:
1. Docker container
2. Kubernetes CronJob
For each installation method, we need to pass the following environment variables:
| Environment Variable | Description |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| API\_KEY | Send-Your-Data API key |
| APPLICATION\_NAME | Set the application name |
| SUBSYSTEM\_NAME | Set the subsystem name |
| COMPANY\_ID | The Company ID from the settings screen in your Coralogix account |
| CORALOGIX\_ENDPOINT\_HOST | Choose the api. endpoint that corresponds to your Coralogix [domain](https://docs-docusaurus.kinsta.page/user-guides/account-management/account-settings/coralogix-domain/.md) using the domain selector at the top of the page |
| CLOUD\_PROVIDER | The Cloud Provider that CSPM will be deployed to in lowercase (e.g. aws, gcp, etc) |
| TESTER\_LIST | If specified, will run the tests on the specified service, otherwise, will run tests on all the AWS services. Leave empty to run all testers, otherwise, use comma separated tester names without spaces. |
| REGION\_LIST | If specified, will check only the specified regions (for global services like AWS S3, IAM and Route53, make sure you add the "global" region). Otherwise, the tests will be conducted in all regions. Leave empty to run on all regions, otherwise, use comma separated region names without spaces. |
| AWS\_DEFAULT\_REGION | AWS default region for authentication |
| ROLE\_ARN\_LIST | An additional role(s) that can be assumed from other AWS accounts to scan. Leave empty to run on the current account. For additional accounts, add comma-separated role ARNs without spaces. **Note**: please follow the instructions below for multi-account configuration. |
| CORALOGIX\_ALERT\_API\_KEY | (Optional parameter) When providing this variable, a custom enrichment for failed resources will be created in Coralogix's account at the end of each run if specified. |
## Installing as a Docker container[](#installing-as-a-docker-container "Direct link to Installing as a Docker container")
### Prerequisites[](#prerequisites "Direct link to Prerequisites")
1. EC2 Instance
* The minimum Instance Type should be "**t3a.medium**"
* Internet connectivity (thorough Internet/NAT Gateway)
2. IAM Role with the [following policy](https://github.com/coralogix/snowbit-cspm-policies/blob/master/AWS/cspm-aws-policy.json) attached to the instance
3. Docker installed on the EC2 instance - refer to [Docker documentation](https://docs.docker.com/engine/install/ubuntu/)
Note that the instance type will affect the run time, so it's up to a personal preference and is affected by the environment size.
### Deploying[](#deploying "Direct link to Deploying")
After prerequisites are met, download the docker image using the following command (if the following command hasn't run, the image will still be downloaded automatically in the next step):
```
docker pull coralogixrepo/snowbit-cspm
```
In order to automate the process, use Crontab in the following manner:
Create the crontab using your favorite editor
```
sudo crontab -e
```
Inside the document, on the bottom, paste the following one-liner (note that the API\_KEY and the CORALOGIX\_ENDPOINT\_HOST fields are mandatory)
```
*/10 * * * * docker rm snowbit-cspm ; docker rmi coralogixrepo/snowbit-cspm ; docker run --name snowbit-cspm -d -e PYTHONUNBUFFERED=1 -e CLOUD_PROVIDER="choose_the_cloud_provider - aws / gcp" -e AWS_DEFAULT_REGION="eu-west-1" -e CORALOGIX_ENDPOINT_HOST="api.eu2.coralogix.com" -e APPLICATION_NAME="application_name" -e COMPANY_ID= -e SUBSYSTEM_NAME="subsystem_name" -e TESTER_LIST="" -e API_KEY="" -e REGION_LIST="" -e ROLE_ARN_LIST="" -e CORALOGIX_ALERT_API_KEY="" --network host -v ~/.aws:/root/.aws coralogixrepo/snowbit-cspm
```
The above command will **try** to run every 10\* minutes, and consists of two commands:
* docker rm snowbit-cspm - removes the last docker container if exists
* docker rmi coralogixrepo/snowbit-cspm - will remove and redownload the docker images to ensure it have the latest images locally available.
* docker run --name snowbit-cspm \[Options...] - runs a new container sequence
\*\* The actual scheduling is set in the Coralogix security tab - scroll to the "**Configuring the scan settings**" section for further details
## Installing as a Kubernetes CronJob in EKS – via kubectl and eksctl[](#installing-as-a-kubernetes-cronjob-in-eks--via-kubectl-and-eksctl "Direct link to Installing as a Kubernetes CronJob in EKS – via kubectl and eksctl")
In order to deploy the image in a pod that follows the principle of least privileged, we should use a service account that assumes the needed role at the start of each job and doesn't inherit its permission from his host node.
### Prerequisites[](#prerequisites-1 "Direct link to Prerequisites")
1. An existing Amazon EKS cluster
2. Version 2.7.21 or later or 1.25.46 or later of the AWS CLI installed and configured on your device or AWS CloudShell
3. The **kubectl** command line tool is installed on your device or AWS CloudShell
4. The **eksctl** command line tool is installed on your device or AWS CloudShell
5. An existing kubectl config file that contains your cluster configuration
6. IAM policy with the [following permissions](https://github.com/coralogix/snowbit-cspm-policies/blob/master/AWS/cspm-aws-policy.json)
### Before deploying[](#before-deploying "Direct link to Before deploying")
Determine whether you have an existing IAM OIDC provider for your cluster:
* Retrieve your cluster's OIDC provider ID and store it in a variable:
```
oidc_id=$(aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text | cut -d '/' -f 5)
```
* Determine whether an IAM OIDC provider with your cluster's ID is already in your account
```
aws iam list-open-id-connect-providers | grep $oidc_id
```
Note: If the output is returned from the previous command, then you already have a provider for your cluster and you can skip the next step. If no output is returned, then you must create an IAM OIDC provider for your cluster
### Deploying[](#deploying-1 "Direct link to Deploying")
If the output from the above test is blank, create an IAM OIDC identity provider for your cluster with the following command. Replace "my-cluster" with your own value
```
eksctl utils associate-iam-oidc-provider --cluster my-cluster --approve
```
Configuring a Kubernetes service account to assume an IAM role (the policy ARN is the policy created in section 6 of the above prerequisites)
```
eksctl create iamserviceaccount --name my-service-account --namespace default --cluster my-cluster --role-name "my-role" --attach-policy-arn arn:aws:iam::111111111111:policy/my-policy --approve
```
Use the following CronJob configurations:
```
apiVersion: batch/v1
kind: CronJob
metadata:
name: snowbit-cspm-cronjob
namespace:
spec:
schedule: "*/10 * * * *"
successfulJobsHistoryLimit: 1
jobTemplate:
spec:
template:
spec:
serviceAccountName:
hostNetwork: true
containers:
- image: coralogixrepo/snowbit-cspm
name: snowbit-cspm-cronjob
command: ["python3"]
args: ["lambda_function.py"]
env:
- name: API_KEY
value: "send_your_data_api_key"
- name: CORALOGIX_ENDPOINT_HOST
value: "api.eu2.coralogix.com"
- name: CLOUD_PROVIDER
value: "choose_the_cloud_provider - aws / gcp"
- name: APPLICATION_NAME
value: "application_name"
- name: SUBSYSTEM_NAME
value: "subsystem_name"
- name: TESTER_LIST
value: ""
- name: REGION_LIST
value: ""
- name: ROLE_ARN_LIST
value: ""
- name: COMPANY_ID
value: ""
- name: PYTHONUNBUFFERED
value: "1"
- name: AWS_DEFAULT_REGION
value: "eu-west-1"
- name: CORALOGIX_ALERT_API_KEY
value: ""
restartPolicy: OnFailure
```
Save the above content into a .yaml file and execute the following command:
```
kubectl create -f Cronjob.yaml
```
## Additional configurations and permissions[](#additional-configurations-and-permissions "Direct link to Additional configurations and permissions")
Several tests for AWS services necessitate specific permissions. If you are utilizing any of these services and would like them to be included in the testing, it is essential to adjust your settings to grant the required permissions. Below is a list of the necessary adjustments for each service. Please ensure these permissions are configured to enable comprehensive testing.
### EKS (Elastic Kuberentes Service)[](#eks-elastic-kuberentes-service "Direct link to EKS (Elastic Kuberentes Service)")
several of the tests are using additional tools that communicating with the clusters using `kubectl`. In order to process actions successfully, your clusters’ configmap `aws-auth` must include CSPM’s IAM role Under `mapRoles` in the following structure:
```
- rolearn: arn:aws:iam:::role/
username:
groups:
- system:masters
```
## Configuring scan settings[](#configuring-scan-settings "Direct link to Configuring scan settings")
Inside the security tab in your Coralogix account, you will find the **SCAN SETTINGS** button:
1. Scan Now will start the scan of the selected environment(s) in up to 10 minutes from pressing (according to the configured cronjob)
2. Scan Schedule allows choosing the frequency of the scans, and the start time of each scan. the default is every 24 hours
[](data:image/webp;base64,UklGRjIgAABXRUJQVlA4ICYgAACwpACdASrTAbIBPm0yl0kkIqIhIZBpiIANiWlu+F6o0xwbyP2f45eR0qv3t/deQ5AF6bs4B+sf6k+8H0gH6n+sR6snoAeXD+3fw//3L/QekB//9ad8Tf1T8lvA3+tfj558/jPyv9a/Lb+y+u7/bf2Dz69U/6D0H/i/1l+9f2v9v/8J7K/5H+0+Kfyj/jvUC/Kf5V/bPzb/uvnHdrbo/+L/yn5AfAL6ffMP87/bP3U/x/nc/0X9a9Q/z3+vf5j3Av5V/Of9H/Zf3q+G/8n4Cnf37K/AH/Kv7F/vf8P+UH0pfwv/U/yn+z/av2y/mf+I/6f+K+Af+Xf1D/lf4L/N/td85X//9yX7o///3UP23//4ogp56fesbvWN3rG71jd6xu9Y3esbvWN3rG71K6MxJpexDQ0h8s04ieen3rG71jd6xu9Y3X7sL+ePUGmZRUdo2NWdg0Y/CyBViUOdruFIxppQTvSAdTxtvt1xebcIjlVn6O0lRsRuF+pA31gIaTA0+YGCQISsjKXe7z0+9Y3eJA2oZ37XbWdh+fOLpWZ1JQPwjCuVWyNljaOugGDbyCwEEnO2wDz0iBKYCnnp96xu9bGtTg9xJYsuJx3np96xu9Y3esbvWN3rG71jd6xu8CAB0+uUmiu5ESdk5dlSMjzg2U5z8Ta+Bz9bPRIg8d56fesbvWN3qV/9/NIQVUPMxJQBTvg9uH7eKgTccJtHs9iWIdyliS4r7HJUSXxt8SWLLwzC7fw3i3j944GehUDUiaEhXg6X3MLvGwTV5iHZLnFnUannz23ObvPT71jd7FgXg8lkutProRiYL9vk+fYvhkv3afWqS34MTYmDfq0h36VvQbncADgh5PX3+vfM92YkofkHHeen3rHXB6lwADrMWTcbtY86YLCTH2t4W6rM2RsHuJLFl3w3XpH9s+F2G2lkHElQe1jd6xu9Y3esbvU0b/lcg71zr8Ivls22I9kxDiigGYcPTPZbfMajrLxPvWN3rG71jd4G6UxVa/75577T9PNXd6hhFkrH3BAdm8ksuEGdFLkYn0MAXwwQPMrf6xE4Uq+48uWVDps3sxwnp96xu9Y3esa2vbp7NGxl+ZS5R2iegnJVkk/36ls3oaJFrfyVV+aRE8T2sbvWN3rG7w388Cf9b+lhw43A3yylCQPCIGOhwHu7L+i676Hh4w5vmjnl1J7C3SHx/rqA/CvsrGxAxSVPRCF7NKNWU3tJiW9xWIENNUqQX94wWIGKSp56fesbqQLynsxIkQnucbzos2d1feROB1fZWNiBikqeehZjQCxQZkwFazKG4f87CF+K1jF7tGPiZGgFZeiaO5RGyDePV2H6wf5puyu0XPJYI4N248apKnnp94j3fcswRpgMn5V1h+/+NFW333oQFoTv/reiQ+VSxTuOwXKUUpQ1osXGgbWrpv79U2c73uDIEPcL6JmKnW9y1vbWJc44MKWNiBikqeen3rHQ2HY3BI7vWN3rIWe4LZjrQknx7ktmOtCSfHuS2Y60JJ8eJxu9Y3esbq43OlFqlpAkZJ9OFLuFwtmj4kIKO/bXlfd8Iom71Dnp96xuvEZS0rPTr+vPEJjk5sv53lew0djjc2DxIo6sX8NF6B/ZBfVdEBlHr4V9lY2IGKIw3VpvEAdhMJYRg+4p9RqlusxOb6o6TpLaHYQ8fueyweUf+MSs6tbfGFUY0/LG71jd6xrWZN7j2vqPk/D6Jz+q4xjM9MJPl5229Ud6ZoUg0ztAga3FJU89PvWN3rG71jd6lAAA/v+4cAAAAFrF0PDMnlNNDFTLtZG0MG8ASoaOFvO1Lw/ytKxY/MYeKUeRI2uzAFVTcrOs9KX0ZIRQVyRgW9gnR4ysRllrX7XmWBHRZe844WFM1cDW73X9MrCyALuGAAANO9MPjhKDFRaW77IUEINOWlBy4fTDkoaUcjl8LnRwJm3hq3ttndT3qCxNYaxsFZmoPMQZazGZ98aXbm6TrZ6ovU/C6QTc8qSGSepNPLARbEVdPdn1eUMzN7l6c8mg9TdPZYdliI0KHczy850lxCGy6cIDJhvXXIVJDny1zjQibOK8EQ03TC4Ymhb4cgjg4RmUuU/J7MDvyBghv4z0+RGsJGJia+pcOYwFETX4EghVJ8eqTjW/tLj0O8MzABIfqWiKsaNeXt/dlifAkFGGoCgJ+1bO6vmQItnMNBmpkQr7V2mtmSZQ4k8c9/pQP+LpRr/3/QBl/xOIL2Kb7Wl+wC/CTxXhiR2Atq/a7b+SVQm3bB0XhnPhKUaaqBnNguN87o+31mogd4KnCk+FGS8w/Vovv6OogfzR0KgQfnGa6veAp/Vbnrb+X0kLjqgcWTBy/ZcxnKJEfKo4P3V/E8iOlrd04CVLtEhbV764u1rNeJAzVYJ5Fow0ThK92NhwzwtDToIs79g95ot37kyQo1W/pPfRXfWthP0klQ11kJIMNlP0NNat728ZBS7Y2OuvGyUATbT3FE6gYkBZQwO/5woGf+F839msvM4j93iP0ZZHTMo5LE3tQbyD4LsrMGdnt5skuninTRGyrv6iTRQKbbcxXqhu8J0zpw+h5sS9ePqJ0yw1QCbeFHN+lGLkRB1qEdElGYU8U9v4c5l4m//8VX+m4AyvLbrTKcey/ygvnkcAaSk5wBKQNiDnSs9EkQ5QpreQj9taQzwgieG2ewN3EMKaTs9C1rlJ1v+g4kAFgk3+fw8S7jqKBrBbLLq/SGIX3OfIZRhQI1Qs7KQg6veDzMtzmvPK0Yi60rNure9BdI6iG/tWADh56ss/QLQuSeg04GNOmA7lFBu/Al6KIFvDWujyGPcqQ6IBB4saYpSgcflMTfVpA6N+AueUtAAZQ1VwJLK7Q1m4SBZVgyQtFduRt9Y7rhadzdf6ZZ8NfRO9cBiaHqfaxOWM4rFB4Z6E63qvwErBCDJNV4feb559XHZXVyhExbQygQRGQiMrx1q/nv2xW7EM06lOzl4D+MsLLaCfqRWVtaxyI5vL6zurc+E3aZSZzZyA7dREARd6bif5+bgDMuGNs4V9G7Phj/B6/QpE+cIEitY098g9A7ZTnoC/UL5gkfXweaG9Ps7QeHCk3WTe8mjTBmCYN9tOqey25UdXvdAFcK3tecmuQ30Jl/kMdqIbMo9Ma/D+/VevlaYQuY9fvkoFlue2Vv1chgnkvoaQWoCYRxvswbfcvc4oU3bem3ddqS7KjrFwIlKc+CgNvXpUZK1DqJAvGjKf1gykteN2hXRwq2UGTGUVsUexY8UAzCjv6RQKHP5hu4hf3A0Ah6t+ERzGAHz/3q2gKqywTATIUPz4OUFhGYkMidPs3g2zd55muqssbQuRndWHsAqjFHKOg4QscTxcmDPZ/vNtgGvGDmQFsbfZGuoRUO2zsxDsRtIjZ99teshcdk+nwr5INaGrrWgFqckOmeqjuujm1SW8Zf3s0SYM+2MElMAV5U1jz9x7YUAeQE9pdeqgBM7Pa2pw5/CP7cOjm9OcSirgEmxZzkXttMWnPfD17Uzk/s32AzPWeFKN1QsST6BrSp4l1ThFw7NUNavXLz+lr2B0pRfx7g2nQDmQRFYBmx9+837bxHID9RSIi2bsqoJKH7A85RlsdpSHyjYM7Y99AIni6B2xFKmcoGqRPmSuBUrg/UhmADUJBIHq/sTDTAAAAAAEgyw6JNsJjONzD7t94RgUgguseIqSsv+NOo7cFaBKnFqOCWxmmmbOsmXfaD1HBVox/9BdzMSRxPLU3JnUVXK6Llr9zerEPaeXSYq1NncVEY6+ieHeSGUJ4cyDwJ9MuLKAg+Jg7hklTcpGFQbWYWm7vpXTjfZS/LQI8hp8i8vK9bI/+dGm4xhbC7nfk+M9tjXnHCQ5dMJagyZn9F+jgXd+HSKI2zPiRexajfQLbflV6h9Tnea8jexm/I9PNFXBTFQVQ+RLJbT0oqq8wbJDTNsvN23JyXtQp5WThKSVHvoOOWz8xah8uZ656lqtl2L11wBa/9wFqmBZQhx4AaYauKfTSEpOwYXSSBVdxlGZuNhWFFBLR85ZKPGL4ePhMGDYxdg6NHTlABPEI5/jVunkBsNp8bSqv9yaWqQyvFhVdASXH6IxiGZyGbDz2Uf+h9DHJhPuEZ2Yq+GMr5bGagNsTJ/qhZzTCH+a9fdMjifruoOTBuo9DGOr/BMkZhVNFqtiiqCf6KKvXfLJhor0jKeYFqkXJenKghZB55MI+YDQSOcyc10xRibiksEp5EsHfQjV/JWqkoDQ9QdDfSee+n62PichaX3GEyr1Rm46qa4gZOMiNoYp/phugUTNTW9r0qG442P+02zwRg448iZaEVgxE3RXcGyC5RNkthTx9fmkAICEAY69pk5tLOAFvMsoMHy0WijfK6pgLlrloNYcvaPsaijeRDaA3QdQGyIQvRIPpeL7H2sAIHWsYTEySUvSjwj/PAa+msH4XTRIUV4UTdO4zRFbQH6d2wR2xyFg6HHDO0WibiTvPIA6agStbbTMrnOCD0huiWf7XU0Eb5fI78e1yjl6SBGYfr8hTQuV63aN+8SI5mujWXCANsLu8LSQu5Enpqj5OBGLbImH3rbKs56bV2zSoAYuwUWtA8wWIZV31UUI9U1y0RKxcAP+jtQc2M13chxhXgD1gO+xaDaGLeHETm1K7TfTw35k07ny2uxteYQpurmhM3yf4o7be8ayG4bb6RB7xWaFkVZk6SAYVdSXM/VaCzHh2qV/sOFurZRkPnEbe5NnOhK1XzLZqvO6GKmDTMlxZKGxSRS87Kh+CKuB8wDXO1lMYF1OhnebReydC/L8KI1z1KLEfunC+hUgfegVJlQlkcYicPvlfVri4HH5YwWTIsoZV0LJwtRwpPmmty1pp9Pw29CJd7H59PrIXXcmRB6blyIboA3RU7tWv+Xl0ozvHi+qu3YNMla7qyolZuHpjBTgXq655J6RxOObu/k+Pli0uVz8NGBoCM+jQ8GIwLa/N/2PFIQuPuVTpc+a1NTt4KnjpBR5traTYIa3iGVUKrW/TRCVJJOOjG02fhMqt6Ylrq+ME+akizccpD3sZYI8BSbqik3MjgAyqqpPkgO/cHPRwePLBzw9JC5WmqnuEv4xez11GA/qfTkl8sFCjLumqWeWksd2oy53KeEHs/MDu8ROLEb1GO9S9VxWTD/W+mQs7CflyjGaP6v47O5jyucY5kwHSzYEpv4NUOepA6vJXAPBC7q5g330wIQIihEsdo60dfpXN5wnlMzBeDT+dqRODlKrQxXOu+lLi6Y45rLd5oLdofw1WmKmg5gzWvEkSbNCSpFj0HpewSEjn67cRUXhI9z54MDd9i1EglNOFW66amhDeTbwwFqOxpNAGb7oCesyE2OmomrFi6/D3+f1t85y2zt/y0O5SdDMBtwMqCED520/S5EEDpPVXDArRe/+LtuF9ed+alBqU+VQdqjyr7aizCt/H8rtDkWdruUIXWhEay0nRHPn+H8Fkz7r2OjUM4s6f3eZWW8PiUl/Sxb7Mxjb3FJiJ1u2DPXbgYLBkvs2036t46xrrhuIYzTVq4SL+DSKgAgYmoPwrvBdHFlobjY8NNvaRhF2Lts9NDdkch3D3NVN/X7A1f42onHPbvD/SYlUzFm010fMINJMYPeD0P0jQPW08Cu6TfsSfk/o5pkAABpFUAzVNWdM27rivE/QQm3b1aVQoLljoywAAAnXbQBIWjhTPJD0W0lF4Z1S76bbZisk/3uPYPxIhfjkSZYiGv4SWtDFiDnKI08PSeHKQbbfIUshe8siMN94PdoCLFqyC9fo7Xw34Im2A//4Eeki8mgMyi/21XkUs3PXycTyrJQ3qMHFH3rXj2sAH9D8TZ3lNk5gHi1dP0PqoDRQA0722nu/GEFCpp+MTj+qnO6+Cldeb94V4k2aytUIF9H98ankLLKOdbX/voR9dSbx/s7HvslDS+dy3NtXA7cw91e+1lDn63bcu8QXtAm6jX/vlk6LZneZOl+9A4IhZB7TULi0HvKsOd+NRg9Y1a/dvt+Gep+nKn/Nq7SGTU1WP83QtqCEiYA2vtKp+L09E7gpv8xorW/0B/B0IGhF7L/CtRQS9QF0WbkFysD1y7m3FW5ClyUpHCDdR7id/rE9MmpYquV09P9l/hWooJeoC6LOelfFzUCeIUE5mmdsckdyENbqxi8pS9GLfojdaABkh27XtY6OVnOurppOldMCfqt+7DiRj0Po9ehOv+0EaaK32UnU55fmD1QsSZLOHhilnA0N1+IQvoqfo9OJwz36hFw80XWMqN5B+EI3mDqDVu9cLMNmMJkNBibKSt6No4EHbQ3L3ws19Au7ziiD3svypMij73YM4OI0UdGgn6HYGVuzt80+WMuTjT1ysmu9Wd+J4KFxCe/t4A/DBBI16JXjimBnGtTRTcOPbRAzxCNOizcdDMMzYbnef8wKQIQ3e6PSBAPswW2pMsZ1hx4KRKWxP7WPVKE7Ij/AYKkQMwbuRu2NG+NYQCY1dtkCYHmqKZxEWhqT40heccx134VFB45A+/9VzcC/bi6n1rQAqbq+Ujtg/wZfQc2h5sGirGx36ha7xkqtwPz/vXtftOZ96Jp7/pN6ma/zE6OQTyh6iBsBd2kyVI5z3oubAalUfDfZj7fj01/O6JCVxK1Nx8M/ln1iDu8b1SwoYLfmV0HZHRlIhXSEOT1Fj9LuUHh5ONebb36xPfLCUaN94rglhTWCVWghK1h6RHgMfZRjJnF2/oC8+I0R1B3DFGJaS8iaiattR8ynNfZMmyVcDW43R0p5lVbZ9KRjTiORf7QamUGPHeZgnZukqJT3huAdoLG8JnF2/oC8+42si3GfMaS1LUM100Q7N48Ylwcq4rDl3RMyD1DHZU9e0ovKDF6IJ1yr6zYE6gzoBzsratAzgmDG9s6uFEAUTSuRoCcROIh6uty6uyMWiOCSdDDx+P4NMFyJulH0lySVm1jyWsC5AJOR1Ckariwg0uKFS3y4e11CP5VyLW+CKwFhAotJlS+vTW1C7ggUSDobEhdYHck/aS9Im2dXWMLms6awPL8Oo6LjCIe0VSi4xB6idANOoAt5us0Phgtehw6b0BPwTEv7z23QTyMZt1HfzENvLD1vsf5Mh5kDp+quCBtfYQLg8a1D9CD0p7co7ubAFwy8J3PbDxtKczw1s3eQ2A5yTTsKH5BLnD+yzWGfxwoZ41o5OJmGRL9rDhn+8xzIzZNuTDG443GUVVrc02v6SOEMvRqcdou4f1wP+kasnM8yTTCTRyYXak/DKF1BTBkRdmIYNx3lohe9kzY8TVq1WicaSZAAWWwK9Ln8Jcif3VgWqCEqLTgLwZDIc/sHgIaFYuzHk3fCjpbV3hbepl3m3X0kOTpKwWN1DoYvY6tM0GP6OUx1abbomxtvs1DhZcxQpXPsP9tFHSXh6yJ8LDQJQrTjoE1ZNLuqCrodiGGhkUhe79jFWLNITA/FoAof+OoPCAgEkhCoXgdTjuIO3BwSAGV7kvBYp8K4K7pGw2uQB6M+rPQvWCf1O+SpYGv3VIO35KNQq8TwQ2VvZ2QhvPuYQWUg1hYccV7v3n2yeMBlwCc9CDB6YoHRVveu/1Q105m1SBozVsOTKf92vkQQWlTNygCf0sdom+cSuTAMBXz/PwJTBLxdEb88AHHmHgyALrLzIapiusZ38GiXL8GLWY8zhjg/I8hnq6is7we5ijp0bn/Zs/QjKSh6Bp/ipDl+nsY3Hf2ysvDKYw4IPn0/lHqlERotQhTPXyXL08f12FFFgdy39RRtXG5XinU32mJKRk/NaWzobeWDeYk1+9WJofrg6OiY/Ig/4uhkkvEESOtxpBRMk0o2rR6/rozU4/bMHbLAVzzsg9NTkH3um3taofslD3EVw5dL6jC5evziKegzOvOapTQz+ibHDPNX6iPzaynGWSzvKzCe5iGzmXoQA4EK4kDTFKlICtdRWTETY9cJC+HxT49Xk4+TT54S0dowNxG2UP1EU8fvX1bV7khYV60JZ6CjHIp9jsNaUZPDlkpFYa5w2abN3DrW8V7ux2OFjh0jlp9MCvLHt7uj8acRy7O0b9MU7jtBeNyYmLsS9H/yIjGKdnNOQITUgXISm11QJMZg5S+MDZE0CrLn6iyDH1Xbjy2h4w8yANzWlz4+ycB2o5ZsZEBKqtLx/ID85lv7lerWDR0lXl5dKDu67c0NwE6qYI9EFd61cYZ9rp5zXZOwbaCZ3+NHNS91/DQ9oubRy4YNFFBZX2Gcc1zcgqsAmPcUQInZV47dNaNIHQa2UlD1eMdxTIeKM4lU5knbB8eZaBjtJxp/XIcSu1Hk/e3v1leT9R1rderMbtlrLAFejlPJmfmQ4gTaAnYF/sETYSNkSZiHme/WP3uiqvf4dLNeY6ouQjvfiFLj/SuD5rVYfXJhZIDsVMs/ozRKs+JPQSeIAej3WDcYHA80U/h2SUzuY5+cmWVxq7nHi3myqyrg7W1px9LRxOflNJEVIJtbQWSuVDvhg9p0+fEmfG91Pz76lNlgRqWIvOPTamQINhz3Mm5vbNFVKUTC6/+ixzDA/Mm3XzM2RviWmY6ySMJa9SzPD2ygIVSmDqf4VL7r7EKaw5Uv0eLxHnWhXvqZbc+u+feaT+QO06xUOWZNCddLHNXpJ7cEc8mlUL/i2+ldwqf1GJxWUqGuTFl7BZ20LdvYifOGKIyKnjK1021Aewy6KRJhHgmRE3qqUViP0eoRDnPWTJYasfmSLHCUgooseoQof2/d7/qmRKlF5rppFryIc+Ixzp7w0oRX5euiVvwXtpjIbo7HululiI82QtjFDUMWS6/1BKg+tbGMpsORqvUFvM/ie9Z0p0G8nq56xxpgqaHC+ZSLFuZ+VCrzz/cDMFiKbMMY/UPeZGYKsJRP2mDw2GGF/5PDcCvPHUczEJ4eFgxj9B08KkK5kuC4cVATdBmMKblOfYpb9P+UdZZDHsvJnbPW3EsJIVSLRgxLpJviRQctiVyvdGNwCwQnMPRWZ/Ynn0d6dLipTE3xZn9OEn6y5hSJJh7RlvBh9D8NkiWwNxi93tkRczDyfaFr9B7OgVBuGV4cZw4lnDqwdYnwSbf85/3bwCVyU1FqIXug5Y9LFD6XeAp7wr0lOl1jSwqyzXk+dj5fHeRcjXcGvGVU2YKSBsUiRiBKsFCAMNoZHrW5aXWT/jFrZsuHHCJnmUTHyJJwf3apndXOePMxUR2zl+9iY6wJZMU7BO9S9agIPjqlR11j5gZWRbxoI0QLcloGpjoWjDuH25rNHuz9+BSVfeCXtj7jBhIG3wvhGjGjFq0jUICJA7xQgb3s+gZb3Ytg9tICTV7J5fp3gN+7DWAn8Ox5Kh/TgF6UwAqaIbDgpq6BE2bZxaCwu2ucdodA+FXgBg1Ue7i7peSgZROKeNHcFxUijuydUyk7i3QT9NA/9TI/s/FKqzI0HFzsUAAAAFj+m9/TJQ628epFo+n6KCg2AP0gVY/6QKsf9IFWP+kCrH/SBVj/pAqx/yH6EAGQ3rY95irxibyfLyeYgVfTCRdC8E4wkrf64nwgI+ogJDEkdqTLrhhzeQdU6R5BWzUOc2JYzTRNotDGlkFZV9Lxoum2xUhfq11lTZP59wn824JVZb+bD/u+f7TWpeRhiH8IJbvn/9FjAKR016gqtnEjKOpKC2c4Twqn8/HtsMOfmwuiUHLP5puqtehrNBWGqCECnjKUbKwW9MwHuqLJZu6XEPGrV/+GfUI5aL9byMz57sxnAJmYlM3wX1YSeSvLIkaWpMeixdswB38omI9G4yHWpCqc/Z29F7E44bBXylDhxkAnQ9YBX9zRoU01v9uFLAR34aDR9p9hP/k0mqCp2CrLx6VKmS4vwuZpj+aM6NA74foIJaYT4AjiVV4zHZKDg3yrMIVSEmr0Hz097zbSEigqF0msLnsi99MqZr+wkbtX+Ed9krEcErmxrFfyPcjwBGuANXSCyyftapo5yfeCzq+6BUYDuBAEZw6a8uFNZaYwcFOfeW8dlLGC9IBBV+Rbe9vejX8YeejpX/uZlt0saBgMXBzzxWOY75jn5YHtAlhSxPQVv2q9gPWe/GrxJhiadiCAX42EWv+MKtOpNFkjYAkDOEXcvbYTR6QGdeuW+f5ntCyl5bqx8RtHyZoxnXxJQ7/cT/baqE+8SWbldqReLlWSJ5Zjncvzf2VmhsO9VGEv7rkJOxyHtvzXb8+nrkx5zSXsHfAyytbiOI8ryT5v1w9WDoqj/m/MTPpT1MDNmmxpYTcS/0YUsmo53NxlmgG6MLHYv7VaiO3yV6y3go4Pi9erHEl8S50Xj4a+EASITqC+GputFLBpAY7YO0isiKgRTeHLXxMwYV8qqGku6yrmdK8JYa8PdTNnYJtckyctGXANysAw8U6Iq0MR3FEg/RlQDavHvZvsYd6PlGoAQeMoMAiaZmYimwvY6ag9CU3iTjftQt4skkhtCm1iTVgX2QWMtSedz2ffmDmwawcSzn8w7mQAJxqvcaQD4aumVpPq3a547uUAdnjBElFlQOT/d3M6v6ReS4a87UdqytPlN3bs7xJgXgsfVSXM/ZxNds5y3HS9eUT8F7A2aDyVOBdF53Yvcoqecqz282Ua2fIkHHDiub5LVk/G5S7akuQYO8OEZjsBCPowltQxewpj3iZ0op9nYWhtPGopxTCBnUoSyPx1pbQYPTVuLED1BKQuWLIPORd9r/xn5Yt+pNW9lpmCV2zneiHxPsE0u66en/VkfTcR1eSb3z2eOgH2wRVMZTWCqwWXn6kiP+uBDKUNXTM3sn8KxDOaaR6hMbL56R1vclHdz0lNOV7/Vn7f8c3bvBDqvjLE2gFP2z6qJGbEyyMD6ywyJcZdlx0HGWH9YZ3UswNP0w/736H5THhDLywfymJPK0Co2phMszzbOQOFsM2PD9HWK8s6OMW6jUxAj4tnR+Pf/+rxFJWKoP5/Lf/+UxTlJi2R13VjQ7FOxwnve/B+0vGBNVt0slB/5S9rKJXnwK42T6DS8QAAAAAA)
## Multi-account configuration[](#multi-account-configuration "Direct link to Multi-account configuration")
**Definitions**
* Primary Account - the account that the CSPM is initially was deployed at
* Additional Account - an account that you wish to be scanned on top of the Primary Account
#### For each additional account[](#for-each-additional-account "Direct link to For each additional account")
1. Go to IAM > Roles and click "Create role"
2. Choose "AWS account"
3. Below, choose "Another AWS account" and paste the account ID of the primary account
4. For permissions, create and add the [following policy](https://github.com/coralogix/snowbit-cspm-policies/blob/master/AWS/cspm-aws-policy.json)
5. Give the Role a name and Click "Create role"
6. Go to the role and copy his ARN
#### For primary account[](#for-primary-account "Direct link to For primary account")
1. Add the [following policy](https://github.com/coralogix/snowbit-cspm-policies/blob/master/AWS/primary_account/assume_roles_permission.json) to the existing CSPM Role (done in the initial deployment)
2. Fill the **resource** key according to the amount of roles to assume
Example for one additional account:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CSPMMultiAccountAccess",
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": "arn:aws:iam::123456789012:role/cspm_additional_account_to_scan"
}
]
}
```
#### Add the environmental variable to the Docker\Kubernetes command[](#add-the-environmental-variable-to-the-dockerkubernetes-command "Direct link to Add the environmental variable to the Docker\Kubernetes command")
1. use the **ROLE\_ARN\_LIST** environmental variable as listed above to point each run to use the role ARN in all the additional accounts.
2. when using more than one account, use comma-separated strings without spaces.
## Limitations[](#limitations "Direct link to Limitations")
CSPM does not support [Scopes](https://docs-docusaurus.kinsta.page/user-guides/account-management/user-management/scopes/.md). To restrict user access to CSPM test results—such as those specific AWS accounts or resources—follow these steps:
1. Deactivate the user’s CSPM [permissions](https://docs-docusaurus.kinsta.page/user-guides/aaa/access-control/permissions/.md) in the `SNOWBIT` preset:
| Description | Action |
| ----------------------------------- | -------------------------------- |
| View CSPM Data | `SNOWBIT.CSPM:READ` |
| View Snowbit Overview Data | `SNOWBIT.OVERVIEW:READ` |
| View Snowbit Resource Explorer Data | `SNOWBIT.RESOURCE-EXPLORER:READ` |
| View Snowbit SSPM Data | `SNOWBIT.SETUP:MANAGE` |
2. View CSPM logs in [Explore](https://docs-docusaurus.kinsta.page/user-guides/data_exploration/.md) or [Custom Dashboards](https://docs-docusaurus.kinsta.page/user-guides/custom-dashboards/introduction/.md), both supporting Scopes. Filter using `cspm` as application and/or subsystem name.
## Additional resources[](#additional-resources "Direct link to Additional resources")
| | |
| ------------------- | ----------------------------------------------------------------------------------------------- |
| Coralogix Endpoints | [Coralogix Endpoints](https://docs-docusaurus.kinsta.page/integrations/coralogix-endpoints/.md) |