AWS inventory scanning

The AWS Inventory integration enables FireTail to automatically scan and discover your API and AI resources in AWS. The integration improves visibility and helps manage API and AI security risks by regularly scanning for new or updated resources. Using AWS IAM roles and CloudFormation templates, FireTail gains the necessary permissions to retrieve the API and AI metadata and updates the selected FireTail application with the discovered resources. You can configure scan regions, set update frequency, and filter by tags to focus on specific environments. To set up the integration:

1. Navigate to Integrations in the FireTail platform.

2. Click AWS Inventory Scanning.

3. In the Name of Integration field, enter a name for the integration. The integration is Enabled by default. Toggle off to make inactive.

4. Choose your deployment method. You can either:

• Use a Launch CloudFormation template - this is a template that adds a role to the account.
• ‍Manually deploy. To do this, click Manual setup of IAM Role and follow the on-screen instructions.

Using the template

• When using the template, select the Launch IAM role CloudFormation template heading.
• Log in to AWS and return to the FireTail platform.
• Click Launch Cloudformation to launch the template. This opens in a new window.
• Select the checkbox; I acknowledge that AWS CloudFormation might create IAM resources. Click Create stack.
• When the CloudFormation Stack has a status of CREATE_COMPLETE, copy the FiretailRoleARN from the Outputs tab.

Manual setup

• Log into the AWS Console.
• Access the IAM Roles section. Click Create role.
• Select AWS account as the trusted entity type. Click Next.
• Search for and select SecurityAudit from the permissions policy.
• Search for and select AmazonBedrockReadOnly from the permissions policy. Click Next.
• Enter a name for the role and click Create role.
• Search for the role you created.

5. Return to the FireTail platform. Paste the copied value in the AWS Role ARN field.

6. Select an application from the dropdown, or click Create to create a new application. Discovered APIs will be grouped under this application. Learn more about applications here.

7. Select the AWS Regions you want to scan.

8. Enter a Scan Frequency. This is how often the scan is done in seconds. The minimum is 900 seconds (15 minutes).

9. Filter on AWS resource (optional). Click Add key - Tags enable you to filter on the environment. Adding tags enables you to limit the scanning of AWS resources with the defined tags. For example, filter by env:prod to limit the scanning of AWS resources to your production environment.

10. Click Submit to complete the setup.

The discovered APIs can be viewed by navigating to the Inventory and selecting the APIs or Applications tab in the FireTail platform. The discovered AI resources can be viewed by navigating to the Inventory and selecting the AI tabs.

When the APIs have been populated on the platform you can then set up API logging using the FireTail API Gateway logging integration.