Connect AWS to Black Cat SSPM
Connect your AWS account so Black Cat can review IAM users and policies, storage exposure, network rules, CloudTrail coverage, encryption keys and account-level security settings.
≈ 10 min · audit access · no write-capable permission
What Black Cat reads, and why
| Permission | What it lets Black Cat do | Status |
|---|---|---|
sts:GetCallerIdentity | Lets Black Cat confirm which AWS account it has been given access to. | Required |
iam:List*, iam:Get*, iam:GenerateCredentialReport | Lets Black Cat review IAM users, their access keys, multi-factor status, password policy and attached policies. | Required |
s3:ListAllMyBuckets, s3:GetBucket* | Lets Black Cat review bucket settings — public access, encryption, versioning and logging — never the objects inside. | Required |
ec2:DescribeRegions, ec2:DescribeSecurityGroups, ec2:DescribeVpcs, ec2:DescribeFlowLogs, ec2:DescribeInstances | Lets Black Cat review security groups, virtual networks, flow logs and running instances across your regions. | Required |
cloudtrail:DescribeTrails, cloudtrail:GetTrailStatus, cloudtrail:GetEventSelectors | Lets Black Cat check that CloudTrail is switched on, multi-region, validated and recording data events. | Required |
kms:ListKeys, kms:DescribeKey, kms:GetKeyRotationStatus | Lets Black Cat review your encryption keys, their state and whether rotation is switched on. | Required |
guardduty:ListDetectors, guardduty:GetDetector | Lets Black Cat check whether GuardDuty threat detection is enabled in each region. | Required |
rds:DescribeDBInstances | Lets Black Cat review database instances for public exposure, encryption and backup retention. | Required |
config:DescribeConfigurationRecorders, config:DescribeConfigurationRecorderStatus | Lets Black Cat check whether AWS Config is recording configuration changes. | Required |
organizations:Describe*, organizations:List* | Lets Black Cat see your organization structure and the accounts it contains. | Optional |
account:GetAlternateContact | Lets Black Cat check that a security contact is registered on the account. | Optional |
securityhub:Describe*, securityhub:Get*, securityhub:List* | Lets Black Cat see whether Security Hub is enabled and which standards it is running. | Optional |
What you'll need
- Read-only role ARN Required — The identifier of the read-only role you create for Black Cat in your AWS account.
- External identifier Required — A secret string of your choosing that the role's trust policy requires Black Cat to present.
- Default region Required — The AWS region Black Cat starts from, for example eu-west-3.