AWS (EC2) Security Groups

Knocknoc can orchestrate Amazon AWS Security Groups, which essentially provide network level firewalling across various asset types, including EC2 VMs, meaning just-in-time network exposure (and access) for authenticated users, tied to your IDP not to AWS IAM or authentication

This is achieved by connecting a Knocknoc orchestration agent to your Knocknoc server, setting up a restricted AWS API user, then proceeding to the per-security-group configuration.

AWS configuration

IAM policy, user and access key

The Knocknoc orchestration agent requires a low number of AWS IAM privileges to add/remove IP addresses from existing firewalls, along with reading existing states. More recently AWS requires users to create-tags, which is also included below.

The broad process is: create the user and related (restricted) policy, then obtain an AWS access key for this user

1. Log in to AWS
2. Visit IAM -> Access Management -> Users and click "Create user"

   

    

3. Provide a sensible name, this may be re-used across assets. Do not grant access to the AWS management console, this is not required.
4. Select "Attach policies directly" if you are doing this for the first time, we need to create a policy. Otherwise select the existing Knoc policy.

   

5. If using the Visual editor:
   1. Type in "EC2"
   2. Search for the below policies and add them. Searching for "securitygroup" helps.
   3. DescribeSecurityGroups, AuthorizeSecurityGroupIngress, AuthorizeSecurityGroupEgress, RevokeSecurityGroupIngress, RevokeSecurityGroupEgress

      

   4. Add "createtags" as Amazon requires this also.

      

6. If using JSON, you can merge this block in with the existing policy header/footer

   		{
   			"Sid": "VisualEditor0",
   			"Effect": "Allow",
   			"Action": [
   				"ec2:RevokeSecurityGroupIngress",
   				"ec2:AuthorizeSecurityGroupEgress",
   				"ec2:AuthorizeSecurityGroupIngress",
   				"ec2:CreateTags",
   				"ec2:RevokeSecurityGroupEgress",
   				"ec2:DescribeSecurityGroups"
   			],
   			"Resource": "*"
   		}

7.  

   Optionally, you can also specify the IP address of the orchestration Agent(s) that may be using this access.
8. Set a policy-name and click Create policy

   

9. Return to your create-user page, and select the policy. This can be easily found by the "filter by type" drop down being "customer managed"

   

10. Select the policy and click Next
11. Click Create User. 
    

Access key

You now need to create an access key for this user, which should be performed alongside the Knoc configuration (below) to copy/paste this information from AWS to Knocknoc, and ideally saved securely in your secret/vault for re-use later should it be required.

1. Visit IAM -> Users -> "your-newly-created-user"
2. Click on "Security credentials"

   

3. Scroll down to "Access keys" and click "Create access key"
4. Select "Command Line Interface (CLI)" and confirm "I understand", and click "Next"
5. Click "Create access key" and optionally add a tag.
6. Copy the "Access key" and "Secret access key" and save these for the Knoc configuration

   

7. You are now complete.

Agent capability + AWS CLI

The orchestration agent granting access via Knocknoc requires the AWS CLI to function, this is provided by Amazon as operating system packages, as "awscli" in most distributions, eg: Redhat/Debian and derivatives.

Debian/Ubuntu: sudo apt-get install awscli

Redhat/etc yum install awscli

$ sudo apt-cache search awscli
awscli - Unified command line interface to Amazon Web Services

$ sudo apt-get install awscli
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following NEW packages will be installed:
  awscli
0 upgraded, 1 newly installed, 0 to remove and 11 not upgraded.
Need to get 0 B/8624 kB of archives.
After this operation, 96.5 MB of additional disk space will be used.
Selecting previously unselected package awscli.
(Reading database ... 69176 files and directories currently installed.)
Preparing to unpack .../awscli_2.9.19-1_all.deb ...
Unpacking awscli (2.9.19-1) ...
Setting up awscli (2.9.19-1) ...
Processing triggers for man-db (2.11.2-2) ...

Knoc configuration

Knoc access flows for AWS are based on the AWS "Security Groups", you will need to obtain information on these along with the region the SG exists within, along with the key information from the IAM configuration to complete the configuration.

AWS Information

1. Log in to AWS
2. Find the Security Group for the asset, in this case we are using an EC2 VM so will view this via the EC2 host

   

3. Scroll down to "Security" (as above)
4. Copy the Security Group ID (sg-xxxxx)
5. Determine the AWS Region, this can be extracted from the "Instance ARN", eg: arn:aws:ec2:REGIONHERE:numbers
6. Proceed to the Knoc configuration as below.
7. Alternatively you can view all Security Groups instead of viewing per EC2 asset, via EC2 -> Security Groups and view all groups, however this depends on your naming...

Knoc configuration

The information obtained earlier from within AWS is required, including the AWS Access key, Secret access key, Security Group and Region.

1. Log in as an Admin, and select Knocs, Create new Knoc
2. Select Firewalls -> Active -> Amazon AWS
3. Provide the AWS "Access Key"
4. Provide the "Secret Access Key"
5. Provide the Region - this is available in AWS for the asset.
6. Provide the Security Group ID
7. Enter the Port (eg: 3389 for RDP)
   
8. Enter a Description for the Knoc/access
9. Provide a URL, if you're using RDP lead with the protocol handler, eg: rdp:// or ssh:// etc.