AWS accounts required permissions

Core Features

These permissions are required to connect AWS cloud accounts to Trend Vision One.

Server & Workload Protection

These permissions are required to view Amazon AWS EC2 and Workspace instances in Server & Workload Protection.

For more information, see Server & Workload Protection.

Cloud Security Posture (included in Core Features)

Container Protection for Amazon ECS

Runtime Scanning:

• sqs:SendMessage

This permission is required by Container Security to enable Runtime Vulnerability Scanning on Amazon ECS clusters.

This permission allows Runtime Scanning to send an SQS message, which triggers vulnerability scans on the running container images.

Runtime Security:

These permissions are required by Container Security to enable Runtime Security on Amazon ECS clusters.

These permissions allow Runtime Security to:

ECS Response:

This permission is required by Container Security to enable container response actions on Amazon ECS Clusters.

The Response Management app uses the ecs:StopTask permission to allow you to stop any tasks in your clusters. This feature is available in Workflow and Automation → Response Management.

For more information, see Container response actions (Isolate/Resume, Terminate).

Agentless Vulnerability & Threat Detection

AppConfig Management Actions:

Agentless Vulnerability & Threat Detection is a serverless function enabled in your connected cloud accounts. The function scans supported cloud resources for vulnerabilities and malware without impact to other resources or running applications.

CloudFormation Operations:

Lambda Function Management:

Storage Operations Actions:

Messaging and Queueing Actions:

Secrets and Parameters Actions:

Logging and Monitoring Actions:

Resource Scanning Capabilities Actions:

State Machine Operations Actions:

Events and Scheduling Actions:

Cost Management Actions:

IAM Role Management Actions:

Cloud Detections for AWS CloudTrail

Collect CloudTrail files in an S3 bucket and forward them to gain insights into user actions and resource activities within this AWS account.

Cloud Detections for VPC Flow Logs

AppConfig Management Actions:

AWS VPC Flow Logs integration allows Trend Vision One to access and monitor your AWS VPC Flow Logs to detected potential threats.

CloudFormation Operations:

Lambda Function Management:

Storage Operations Actions:

Messaging and Queueing Actions:

Secrets and Parameters Actions:

Logging and Monitoring Actions:

VPC and Network Monitoring Actions:

Events and Scheduling Actions:

Cost Management Actions:

IAM Role Management Actions:

Cloud Detections for Amazon Security Lake

These permissions enable Security Lake to forward and analyze logs, providing insights into [PersonType] actions and resource activities in the AWS account.

Cloud Response for AWS

Cloud Response for AWS these permissions to take response actions to contain incidents within your cloud account, such as revoking access for suspicious IAM users.

File Security Storage

These permissions are required for File Security Storage to perform anti-malware scanning on files in cloud storage services.

When a user or program uploads a file to a designated cloud storage container, File Security Storage performs a scan.

Data Security Posture

These permissions are required by Data Security Posture to monitor your AWS cloud assets for sensitive data.