Connecting AWS management account and provided CloudFormation template

[Bojan Pasic]

Hi everyone,

when following instructions to connect AWS environment to MDC (connecting AWS management account) I've deployed provided CloudFormation template both as a Stack and as a StackSet. Step 12 in the guide (https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-setting...) says following:

"Using the downloaded CloudFormation template, create the stack in AWS as instructed on screen. If you're onboarding a management account, you'll need to run the CloudFormation template both as Stack and as StackSet."

But there is an issue with deployment of some of the Stack instances. I've selected two AWS regions during StackSet deployment (us-east-1 and us-west-1), deployment in us-east-1 succeeded but deployment in us-west1 failed (within the same AWS account). The reason is that IAM roles (provided CloudFormation template deploys mostly IAM roles), which are global resources, were already deployed in us-east-1 and deployment fails when it tries to deploy same IAM role in us-west-1.

Has anyone else noticed same behavior? I guess that provided CloudFormation template need to be modified so that it doesn't try to deploy IAM roles if they are deployed in some other region (i.e. make sure that IAM roles are deployed only in single region, something like "main" region which can be defined as parameter).

[#2 · Accepted solution]

Hi Bojan! There is no need for two regions. If you select one region, it should work just fine. Let me know, if you have any questions.

[#3]

@Bojan Magusic thanks for the reply. I was concerned that maybe some connector resources needs to be deployed to all regions where we have AWS resources running.

In the mean time I deployed EC2 instances to both regions (us-east-1 and us-west-1) and both of them were onboarded to Defender for Cloud.

[#4]

Hello Bojan, We are about to do a POC of the AWS connector into DfC, are there any insights you can share? Hoping to utilize the alerts/recommendations and compliance as well as porting data to Sentinel. Appreciate any suggestions/advice.

Cheers,
Serge