As a part of the AWS cloud provider integration, Vanta supports the detection and linking of all your AWS accounts via your AWS Organization Management account.
When connecting via your AWS Organization, Vanta will scan all the AWS accounts associated with your AWS Organization and detect when AWS accounts are added or deleted in your organization - then automatically update your inventory in Vanta.
If you are migrating from connecting via individual AWS accounts, please complete Delete individual AWS accounts in Vanta first.
If this is your first time connecting Vanta with AWS, you can Prepare your AWS Environment.
Delete individual AWS accounts in Vanta
If you have already connected AWS with Vanta by adding individual AWS accounts, you must delete those accounts before you can connect via your AWS Organization.
If you've assigned owners or descriptions for resources within Vanta, these data will be erased when you delete your credentials. If this prevents you from migrating to AWS Organizations, don't hesitate to contact support.
To delete AWS accounts, go to Integrations, Cloud Providers, and Amazon Web Services.
Select Manage followed by Edit and then Delete (trash icon) or Delete all accounts.
Prepare your AWS environment
To prepare your AWS environment to integrate with Vanta, you need to do the following two things:
In Vanta, go to Integrations > Cloud providers and add AWS. In the connection flow, choose to connect with "Organization."
Select Products
During the first connection step, You'll be prompted to select the products from AWS you'd like to connect to Vanta. The products selected may change the Policy Permission generated on the Policy Creation step. For Example, Adding the AWS CodeCommit product generates the associated permissions needed in the Policy:
Policy creation
For each account, create a policy in AWS policy creator:
Navigate to the AWS policy creator.
Once there, click on the JSON tab. Note: AWS inline policies are not supported.Paste the policy: Take the snippet in the step below and paste it into the AWS Policy editor:
Review the policy and name the policy
VantaAdditionalPermissionsClick Create policy
Role creation
For each account, create a role in AWS role creator:
Configure your Management account and connect to Vanta
For your Aws Management Account, create a policy in AWS policy creator:
Navigate to the AWS policy creator. Once there, click on the JSON tab. Note: AWS inline policies are not supported
Paste the policy:
Take the snippet in the step below and paste it into the AWS Policy editor:
Review the policy and name the policy
VantaManagementAccountPermissionsClick Create policy
When prompted, enter the ARN of the “vanta-auditor” role you created in your Management account.
You can select all regions where you have the infrastructure. Vanta will scan your organization for resources in all your chosen regions.
Vanta will scan your AWS Organization for accounts and resources. It can take up to 2 hours to finish scanning.
You can see your AWS accounts in Inventory after completing the scan.
To configure the scope of your scanned resources for each AWS account, go to Integrations > Configure scope.