AWS Integration: Discover Cloud Resources

Cloud infrastructure changes quickly. Instances start and stop, storage volumes move, databases scale, and network resources are updated across regions. Without a central view, IT teams can lose track of what exists, where it runs, and how it connects to the rest of their infrastructure.

With AWS Cloud Integration in AssetSonar, you can connect your AWS account, import supported AWS resources, and view them from the AWS Resources tab under Items.

This guide walks you through enabling the integration, authorizing AWS access using the recommended IAM Role method, selecting regions and resources, reviewing imported AWS resources, enabling optional live tracking, and checking sync status.

---

1. Enable AWS Cloud Integration

To turn on the AWS integration:

1. Go to Settings → Integrations → Mobile Device Management & Network Discovery, then locate AWS Cloud settings.
2. Select Enabled.
3. Click Update.

Once enabled, AssetSonar displays the AWS authorization setup.

Note: You can configure multiple AWS regions within the account you connect.

---

2. Create an External ID

AssetSonar uses an External ID to securely assume the AWS IAM Role created for the integration. The External ID must match the value added to the role’s AWS IAM trust policy.

To create an External ID:

1. Generate a secure, unique string. You can use a UUID or another random string approved by your AWS administrator.
2. Keep this value ready. You will add it to the AWS IAM Role trust policy and then enter the same value in AssetSonar.

Example External ID: 1a1z2tt2bcxcbk75af94e17284s605dsdq

Note: The External ID is not a password or access key. It is a security control used by AWS to make sure the role can only be assumed when the correct External ID is supplied.

---

3. Create an IAM Policy in AWS

AssetSonar uses an AWS IAM Role with read-only permissions to access supported AWS resource data securely. This setup uses AWS Security Token Service (STS), an External ID, and a dedicated IAM role so AssetSonar can sync supported AWS resources without requiring long-term access keys.

The IAM policy you create should include permissions for the AWS resources you want to import into AssetSonar. If you plan to track only selected resource types, you can remove permissions that are not relevant to those resources. For example, if you do not want to import RDS resources, your AWS administrator can remove the RDS permissions from the policy.

If you are unsure which permissions are required for your selected resources, contact AssetSonar support at support@ezo.io before making changes.

To create the IAM policy:

1. Log in to your AWS Management Console.
2. Go to IAM → Policies.
3. Click Create policy.
4. Open the JSON tab.
5. Paste the following policy, or adjust it based on the AWS resource types you want AssetSonar to import:

{
"Version": "2012-10-17",
"Statement": [
  {
    "Sid": "AssetSonarAWSCloudResourceReadOnly",
    "Effect": "Allow",
    "Action": [
      "ec2:DescribeInstances",
      "ec2:DescribeInstanceStatus",
      "ec2:DescribeRegions",
      "ec2:DescribeTags",
      "ec2:DescribeVolumes",
      "ec2:DescribeNetworkInterfaces",
      "ec2:DescribeVpcs",
      "ec2:DescribeSubnets",
      "ec2:DescribeSecurityGroups",
      "elasticloadbalancing:DescribeLoadBalancers",
      "elasticloadbalancing:DescribeTargetGroups",
      "elasticloadbalancing:DescribeTargetHealth",
      "rds:DescribeDBInstances",
      "rds:DescribeDBClusters",
      "autoscaling:DescribeAutoScalingGroups",
      "tag:GetResources"
    ],
    "Resource": "*"
  }
]
}

6. Click Next.
7. Enter a policy name, such as AssetSonarAWSCloudResourceReadOnlyPolicy.
8. Review the policy and click Create policy.

Note: This policy provides read-only access to supported AWS resources for discovery and sync. It can be configured based on the AWS resource types you want to import. Your AWS administrator may remove irrelevant permissions for modules you do not want to track, but the final policy must still allow AssetSonar to read the AWS resources selected for sync. 

---

4. Create an IAM Role and Add the External ID

After creating the policy, create an IAM Role that AssetSonar can use to access supported AWS resource data.

To create the role:

1. Go to IAM → Roles.
2. Click Create role.
3. Select the relevant trusted entity option for a custom trust policy.
4. Add the trust policy provided below.
5. Replace Add Your Secure String with the External ID you created earlier.

{
"Version": "2012-10-17",
"Statement": [
  {
    "Sid": "AllowAssumeRoleWithExternalId",
    "Effect": "Allow",
    "Principal": {
      "AWS": "*"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "Add Your Secure String"
      }
    }
  }
]
}

6. Click Next.
7. Attach the policy you created earlier, such as AssetSonarAWSCloudResourceReadOnlyPolicy.
8. Enter the following role name: iap_assetsonar_role
9. Review the role and click Create role.

---

5. Retrieve the IAM Role ARN and Add Details in AssetSonar

After creating the IAM Role:

1. Go to IAM → Roles.
2. Open the role you created for AssetSonar.
3. Copy the Role ARN.

The Role ARN will look similar to this:

arn:aws:iam::<ACCOUNT_ID>:role/iap_assetsonar_role

Now return to AssetSonar:

1. Go to Settings → Integrations → Mobile Device Management & Network Discovery → AWS Cloud.
2. Click Connect.
3. Enter the same External ID you added to the AWS IAM Role trust policy.
4. Paste the Role ARN copied from AWS.
5. Click Add.

AssetSonar can then use the Role ARN and External ID to assume the AWS IAM Role and begin syncing supported AWS resources.

Warning: The External ID in AssetSonar must exactly match the sts:ExternalId value in your AWS IAM Role trust policy. If the values do not match, AWS will block the role assumption and the sync will fail.

---

6. Select AWS Regions and Resources

After the Role ARN is saved, configure the AWS regions and resources AssetSonar should sync.

To select regions and resources:

1. Return to AWS Cloud settings.
2. In the Regions field, select the AWS regions you want to monitor.
3. In the Resources field, select the AWS resource types you want AssetSonar to import.
4. Click Update.

By default, AssetSonar starts with us-east-1 and Cloud Servers / Virtual Machines.

Supported AWS resources include:

• EC2 Instances
• Storage Volumes
• Network Interfaces
• Virtual Networks (VPCs)
• Subnets
• Security Groups
• Load Balancers
• Target Groups
• Auto Scaling Groups
• DB Subnet Groups
• Database Clusters
• Managed Databases

Note: Select only the regions and resources you actively want to monitor. This keeps the AWS Resources view focused and makes sync status easier to review.

6.1 Which AWS Resources Count as Assets for Pricing

AssetSonar can discover and map several AWS resource types as Configuration Items. For pricing purposes, however, only the following imported AWS resources count as Assets:

• EC2 Instances → Compute Instances
• Storage Volumes → Block Volumes
• Load Balancers → Load Balancers
• Managed Databases → Managed Databases
• Database Clusters → Database Clusters

Each imported resource record belonging to one of these types counts as one Asset for pricing.

Other supported AWS resources, such as Network Interfaces, Virtual Networks (VPCs), Subnets, Security Groups, Target Groups, Auto Scaling Groups, and DB Subnet Groups will be added for free. For more information, view AssetSonar Pricing Plans.

---

7. Enable Live State Tracking for AWS Resources

In addition to the regular AWS inventory sync, AssetSonar allows you to enable live state tracking for supported AWS resources.

Live tracking uses AWS services to capture supported resource events from the regions you configure and send the resulting updates to AssetSonar. 

To set up live tracking, go to Settings → Integrations → Mobile Device Management & Network Discovery → AWS Cloud and select Enable live state tracking.

Once enabled, AssetSonar displays the Download Terraform option.

7.1 Download the Terraform Configuration

Before proceeding, make sure you have Terraform 1.5 or later installed. 

Click Download Terraform to download the Terraform package provided by AssetSonar.

After downloading the package:

1. Unzip the file.
2. Open the extracted folder in the command line.
3. Navigate to the Terraform directory:

cd aws_cloud_live_tracking_terraform

The Terraform package contains the configuration required to deploy the AWS resources used for live tracking.

7.2 Configure Permissions for Running Terraform

The AWS user or role you use to run Terraform must have the permissions required to deploy and manage the live-tracking resources.

If you want to create a separate AWS user with least-access permissions for this purpose, use the AssetSonar AWS Live Tracking Terraform Permissions JSON provided below.

View AssetSonar AWS Live Tracking Terraform Permissions JSON

The JSON contains the combined permissions required to apply and remove the Terraform deployment. Before attaching the policy, replace:

• ACCOUNT_ID with your AWS account ID.
• REGION with the AWS region in which the relevant resources are being deployed.
• For additional subscribed_regions, configure the corresponding regional EventBridge rule ARNs.

Note: Use the complete permissions policy provided in the JSON file. The policy includes the create, update, delete, and iam:PassRole permissions required by the Terraform configuration.

7.3 Configure the Terraform Variables

From the Terraform directory, copy the example variables file:

cp terraform.tfvars.example terraform.tfvars

Open terraform.tfvars and configure the following values:

Variable	What to enter
assetsonar_base_url	Your AssetSonar company URL, for example https://subdomain.assetsonar.com. A trailing slash is not required.
itam_access_token	Your company ITAM token
primary_region	The AWS region where SQS, Lambda, the custom EventBridge bus, and Scheduler are created
subscribed_regions	The AWS regions where the catalog EventBridge rules should be created

The primary_region is always included in subscribed_regions, even if you do not explicitly add it there.

7.4 Initialize and Apply Terraform

Run the following commands from the Terraform directory:

terraform init

terraform plan

terraform apply

Review the Terraform plan and type yes when prompted to apply the configuration.

The deployment sets up the AWS infrastructure used for live tracking, including an SQS queue, EventBridge resources, a Lambda function, CloudWatch logging, an EventBridge Scheduler, and the required IAM roles and policies. Regional EventBridge rules are also configured for supported EC2, EBS, and RDS events.

Once the Terraform deployment is complete, AssetSonar can use this infrastructure for live state tracking while the existing AWS inventory synchronization continues to provide the regular inventory sync.

7.5 Review the AWS Resources Created for Live Tracking

The Terraform deployment creates the AWS resources required for live state tracking. Their names are predefined in the Terraform configuration; changing the AWS region changes where they are created, not their names.

In the configured primary_region, Terraform creates:

AWS resource	Resource name
SQS queue	assetsonar-cloud-inventory-live-state
EventBridge custom bus	assetsonar-cloud-inventory-live-state
EventBridge rule	assetsonar-cloud-inventory-live-state-to-sqs
Lambda function	assetsonar-cloud-inventory-live-tracking
CloudWatch log group	/aws/lambda/assetsonar-cloud-inventory-live-tracking
EventBridge Scheduler	assetsonar-cloud-inventory-live-tracking-drain
Lambda IAM role	assetsonar-cloud-inventory-live-tracking-role
Lambda IAM inline policy	assetsonar-cloud-inventory-live-tracking-policy
EventBridge PutEvents IAM role	assetsonar-cloud-inventory-live-state-put-events
EventBridge PutEvents IAM inline policy	assetsonar-cloud-inventory-live-state-put-events
Scheduler IAM role	assetsonar-cloud-inventory-live-tracking-scheduler
Scheduler IAM inline policy	assetsonar-cloud-inventory-live-tracking-scheduler

For every region included in subscribed_regions, Terraform creates the applicable EventBridge rules for supported resource events. These rules use the same names in every subscribed region: 

EventBridge rule	Tracks
assetsonar-lt-ec2_instance_state_change	EC2 instance state
assetsonar-lt-ebs_volume_notification	EBS volume
assetsonar-lt-rds_db_instance_event	RDS instance
assetsonar-lt-rds_db_cluster_event	RDS cluster

The primary_region is always included among the subscribed regions.

Note: The live-tracking Terraform stack does not create EC2 instances, RDS instances, or the iap_assetsonar_role used by the standard AWS inventory integration.

---

8. Run or Review AWS Sync

After setup, you need to click on Sync Now to start importing the selected resources from the selected regions.

To review sync timing:

1. Return to AWS Cloud settings.
2. Check Last Synced At to see when the latest sync was completed.

AssetSonar also sends sync emails to keep you informed when:

• AWS sync is in progress
• AWS sync is completed
• AWS sync has failed

---

9. View Imported AWS Resources

Once the sync completes, you can view imported AWS resources from the Items module.

To view AWS resources:

1. Go to Items → AWS Resources.
2. Use the resource list to review imported AWS infrastructure.
3. Use filters such as State, Sync Source, Region, and Availability Zone to narrow down the list. Click any AWS resource to open its detail page. 

---

10. Retire, Activate, or Delete AWS Cloud Resources

You can retire or delete AWS resources imported into AssetSonar directly from the AWS Resources listing or resource detail page.

Retire an AWS Resource

Use the Retire action to mark an AWS resource as retired. You can also retire multiple resources in bulk.

When an AWS resource is retired:

• Its State changes to Retired.
• It is removed from the Asset count used for pricing, where applicable.
• It remains available in AssetSonar and continues to appear in IT Graph with a retired status.

You can also enable Make retired resources active if discovered again from the AWS Cloud integration settings.

If this setting is enabled and AssetSonar discovers a retired AWS resource again during synchronization, its state is updated based on the latest data pulled from AWS and it is included in pricing again where applicable.

You can also use the Activate action on a retired resource. AssetSonar will poll AWS again and, if the resource still exists, update its state accordingly.

Delete an AWS Resource

Use Delete when you want to remove the AWS resource record from AssetSonar.

Deleting a resource:

• Removes the record from AssetSonar.
• Removes it from the Asset count used for pricing.
• Removes its existing linkages because the record is no longer available.

If the resource still exists in AWS and is discovered again during a later sync, AssetSonar can populate it again.

Note: Retired AWS resources remain visible in IT Graph with a Retired status. Deleted resources are removed along with their existing relationships.

---

11. Review AWS Resource Relationships

AssetSonar also maps supported relationships between synced AWS resources. These relationships help you understand how your cloud infrastructure is connected.

For example:

• A Virtual Network (VPC) contains Subnets
• A Subnet hosts Cloud Servers / Virtual Machines
• A Cloud Server / Virtual Machine is attached to Storage Volumes
• A Cloud Server / Virtual Machine uses Network Interfaces
• A Security Group protects servers, interfaces, databases, or load balancers
• A Load Balancer routes traffic to Target Groups
• An Auto Scaling Group manages cloud servers
• A Database Cluster contains Managed Databases

To view relationships:

1. Go to Items → AWS Resources.
2. Open the relevant AWS resource.
3. Click the Relationships tab.

Use this view to understand infrastructure dependencies and troubleshoot cloud resource impact from a single place.

---

Ready to Bring AWS Infrastructure into AssetSonar?

With AWS Cloud Integration, AssetSonar helps you bring cloud servers, storage, networking, databases, load balancers, scaling groups, and resource tags into one operational view. You can monitor AWS resources across selected regions, review sync health, and understand how cloud infrastructure components relate to one another.Need help setting up the AWS role or reviewing sync failures? Reach out to us at support@ezo.io — we’re happy to assist.