Skip to main content

AWS (EC2) Security Groups

Knocknoc can orchestrate Amazon AWS Security Groups, which essentially provide network level firewalling across various asset types, including EC2 VMs, meaning just-in-time network exposure (and access) for authenticated users, tied to your IDP not to AWS IAM or authentication

This is achieved by connecting a Knocknoc orchestration agent to your Knocknoc server, setting up a restricted AWS API user, then proceeding to the per-security-group configuration.

AWS configuration

IAM policy, user and access key

The Knocknoc orchestration agent requires a low number of AWS IAM privileges to add/remove IP addresses from existing firewalls, along with reading existing states. More recently AWS requires users to create-tags, which is also included below.

The broad process is: create the user and related (restricted) policy, then obtain an AWS access key for this user

  1. Log in to AWS
  2. Visit IAM -> Access Management -> Users and click "Create user"

    IAM > Users, the user list before any user exists, with the Create user button

     

  3. Provide a sensible name, this may be re-used across assets. Do not grant access to the AWS management console, this is not required.Create user, Step 1 Specify user details, with the IAM user name typed in
  4. Select "Attach policies directly" if you are doing this for the first time, we need to create a policy. Otherwise select the existing Knoc policy.

    Create user, Step 2 Set permissions, with Attach policies directly chosen

  5. If using the Visual editor:
    1. Type in "EC2"
    2. Search for the below policies and add them. Searching for "securitygroup" helps.
    3. DescribeSecurityGroups, AuthorizeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupIngress, RevokeSecurityGroupEgress

      Create policy, the visual editor filtered to securitygroup, with the authorize, revoke and describe actions ticked

    4. Add "createtags" as Amazon requires this also.

      Create policy, the visual editor filtered to createtags, with CreateTags ticked

  6. If using JSON, you can merge this block in with the existing policy header/footerCreate policy, the JSON editor showing the six EC2 actions against all resources 
    		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"ec2:RevokeSecurityGroupIngress",
				"ec2:AuthorizeSecurityGroupEgress",
				"ec2:AuthorizeSecurityGroupIngress",
				"ec2:CreateTags",
				"ec2:RevokeSecurityGroupEgress",
				"ec2:DescribeSecurityGroups"
			],
			"Resource": "*"
		}

  7.  

    Optionally, you can also specify the IP address of the orchestration Agent(s) that may be using this access.The policy summary, listing the six actions and the optional Requested from IP condition
  8. Set a policy-name and click Create policy

    Create policy, Step 2 Review and create, with the policy name typed in

  9. Return to your create-user page, and select the policy. This can be easily found by the "filter by type" drop down being "customer managed"

    Create user, Set permissions with the new customer managed policy listed and filtered to Customer managed

  10. Select the policy and click Next
  11. Click Create User. 
Access key

You now need to create an access key for this user, which should be performed alongside the Knoc configuration (below) to copy/paste this information from AWS to Knocknoc, and ideally saved securely in your secret/vault for re-use later should it be required.

  1. Visit IAM -> Users -> "your-newly-created-user"
  2. Click on "Security credentials"

    The IAM user's Summary, with its ARN and console access disabled

  3. Scroll down to "Access keys" and click "Create access key"
  4. Select "Command Line Interface (CLI)" and confirm "I understand", and click "Next"
  5. Click "Create access key" and optionally add a tag.
  6. Copy the "Access key" and "Secret access key" and save these for the Knoc configuration

    Create access key, Step 3 Retrieve access keys, with the access key shown and the secret still hidden

  7. You are now complete.

Agent capability + AWS CLI

The orchestration agent granting access via Knocknoc requires the AWS CLI to function, this is provided by Amazon as operating system packages, as "awscli" in most distributions, e.g., Redhat/Debian/derivatives and Windows

Linux

Debian/Ubuntu: sudo apt-get install awscli

Redhat/etc yum install awscli

$ sudo apt-cache search awscli
awscli - Unified command line interface to Amazon Web Services

$ sudo apt-get install awscli
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  awscli
0 upgraded, 1 newly installed, 0 to remove and 11 not upgraded.
Need to get 0 B/8624 kB of archives.
After this operation, 96.5 MB of additional disk space will be used.
Selecting previously unselected package awscli.
(Reading database ... 69176 files and directories currently installed.)
Preparing to unpack .../awscli_2.9.19-1_all.deb ...
Unpacking awscli (2.9.19-1) ...
Setting up awscli (2.9.19-1) ...
Processing triggers for man-db (2.11.2-2) ...

Microsoft Windows

Download the Windows CLI package from here: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html The AWS documentation page for installing or updating the AWS CLI on Windows

If you installed the CLI after the Agent, you may need to restart the Agent to pick up the new path. Assign the Knoc to the Windows Agent and you're away.

Knoc configuration

Knoc access flows for AWS are based on the AWS "Security Groups", you will need to obtain information on these along with the region the SG exists within, along with the key information from the IAM configuration to complete the configuration.

AWS Information
  1. Log in to AWS
  2. Find the Security Group for the asset, in this case we are using an EC2 VM so will view this via the EC2 host

    The EC2 instance summary, with the instance ID, its addresses and its type

  3. Scroll down to "Security" (as above)
  4. Copy the Security Group ID (sg-xxxxx)The EC2 instance's Security tab, showing the security group it belongs to
  5. Determine the AWS Region, this can be extracted from the "Instance ARN", e.g., arn:aws:ec2:REGIONHERE:numbers
  6. Proceed to the Knoc configuration as below.
  7. Alternatively you can view all Security Groups instead of viewing per EC2 asset, via EC2 -> Security Groups and view all groups, however this depends on your naming...
Knoc configuration

The information obtained earlier from within AWS is required, including the AWS Access key, Secret access key, Security Group and Region.

In the Knocknoc admin portal, go to Knocs, choose Create new knoc, then AWS SG under Inline. The integration holds the credentials and can be reused by other AWS knocs. Choose the agent, then provide the Access Key ID and Secret Access Key:

Wizard step 1, the AWS SG integration, with the agent and the access key

The knoc holds what gets written. Give the Security Group ID, the port (3389 for RDP), the region the group is in, the direction and protocol, a description, and a URL. If you are using RDP, lead with the protocol handler, for example rdp:// or ssh://.

Wizard step 2, the knoc settings, with the security group, port and region

The AWS Security Group will now be updated with the end-user's IP address dynamically, and be automatically removed on user logout or after the pre-defined time period.