AWS Organization Onboarding

This article details the steps to onboard your AWS Organization to Panoptica using the CloudFormation StackSets service.

The process includes two steps:
Step 1: Onboarding your organization’s management (master) account and creating the StackSet.
Step 2: Configuring the StackSet and onboarding your member accounts.

📘

Prerequisites

• Enable StackSet trusted access with AWS Organizations. An AWS guide on how to do this can be found here. Note that this requires an Admin on the management account.
• The user performing the onboarding must have the relevant permissions to create and deploy CloudFormation Stacks and StackSets.
• If you have already onboarded accounts in this Organization to Panoptica via the regular onboarding flow, they must be deleted from Panoptica (via the account page) before the AWS organization onboarding begins.

Onboarding Process

Step 1:

1. Log into your organization management (master) account in AWS.
2. Input the management (master) account ID and select a display name for this account on Panoptica.
3. In the Panoptica console, select Settings in the main navigation pane, then the Accounts tab. Choose Amazon Web Services to open a pop-up overlay.
4. Select Advance Mode, and Deploy AWS organization. Follow the regular steps to Onboarding an AWS account.
5. When you click Launch Stack, a new browser tab will open to your AWS console.
6. Select the I acknowledge that AWS CloudFormation might create IAM resources checkbox, and then click Create Stack. You can change the Stack name field if you want.

7. CloudFormation will deploy the resources in the management account so that you can see the creation status in AWS and make sure you see three resources with “CREATE_COMPLETE” status.
   The deployed resources are:

• A role on the management account so Panoptica can scan it.
• A StackSet to onboard the member accounts.
• An SNS alerting Panoptica to the new account, so we can onboard and automatically scan it.

Once all three resources show "CREATE_COMPLETE" under Status, the first step is done.

Your management account should be onboarded to Panoptica shortly thereafter, and the scan will automatically start after that. In addition, we've created the StackSet required for Step 2 - onboarding the member accounts.

Step 2:

1. Once all resources are created successfully, click StackSets from the menu to the left, and then click the PanopticaSecurityAudit StackSet that was created.

2. Click the Actions drop-down menu and select the Add stacks to StackSet option.

3. Set deployment targets:
   We recommend onboarding the entire Organization, but you can choose to onboard accounts from specific OUs (Organizational Units) as well.

4. Specify regions:
   Select the US East (Ohio) region from the drop-down list. Once done, click Next.

5. Click Next again in the next step, and after the final review click Submit to start the deployment.

Congratulations! You can now view the “Stack instances” tab to see the status of each account's deployment.

Each account that was successfully deployed should be onboarded and scanned in a matter of minutes. You can see the accounts and their statuses in Panoptica’s Accounts page.

📘

Note:

For larger Organizations, the initial scan of all accounts may take some time to complete.