Guides

AWS GovCloud Setup & Permissions for RegScale CLI

This guide documents the IAM permissions and configuration needed to run the RegScale CLI AWS integration (regscale aws ...) against an AWS GovCloud (US) account. It is broken down by command so a customer can grant only what they need.

Suggest Edits

GovCloud platform notes

  • Partition: aws-us-gov (not aws). Resource ARNs and trust policies must
    use this partition.
  • Regions: us-gov-west-1 and us-gov-east-1.
  • Endpoints: Resolved automatically by the AWS SDK when you set the region;
    no endpoint override is required in init.yaml.
  • IAM Identity Center / SSO: GovCloud has its own IDC instance. The
    regscale aws auth login flow works with GovCloud SSO start URLs.

Service availability for the AWS commands shipped in RegScale CLI

Per the AWS GovCloud service availability documentation, all services that
RegScale CLI's AWS integration depends on are available in at least one
GovCloud region:

RegScale CLI commandAWS serviceGovCloud availability
sync_assets, inventory collectEC2, S3, RDS, Lambda, ECS, IAM, KMS, etc.Available
sync_iamIAMAvailable
sync_kmsKMSAvailable
sync_s3S3Available
sync_cloudtrailCloudTrailAvailable
sync_cloudwatch, sync_cloudwatch_exCloudWatch LogsAvailable
sync_ssmSystems ManagerAvailable
sync_ecrECRAvailable
sync_orgOrganizationsAvailable
sync_guarddutyGuardDutyAvailable
sync_inspector, inspector import_scansInspector v2Available
sync_directory_servicesDirectory ServiceAvailable
sync_ec2EC2Available
sync_config_complianceAWS ConfigAvailable
sync_complianceAudit ManagerAvailable
sync_findings, sync_findings_and_assetsSecurity HubAvailable

Approval status: Every service listed above is present on the AWS
GovCloud services page, which means AWS has authorized it for use in
GovCloud (FedRAMP High at minimum; many services also DoD CC SRG
IL2/IL4/IL5 and ITAR). If a service is in GovCloud, it is approved for
GovCloud workloads — there is no further AWS-side gate.

The remaining gates are customer-side, not AWS-side:

  1. Has the customer enabled the service in their account
    (Security Hub, GuardDuty detector, Inspector v2 enablement, Config
    recorder, etc.)? Check the AWS console for that account.
  2. Does the service's impact level meet the workload's ATO requirement
    (FedRAMP High vs DoD IL5)? Verify on the
    GovCloud services page.

If a service is approved+available but not yet enabled, the corresponding
RegScale CLI command will return empty results until enablement. Use
sync_config_compliance (AWS Config) as a compliance alternative if Audit
Manager isn't enabled, and sync_guardduty / sync_inspector /
sync_cloudtrail as findings alternatives if Security Hub isn't enabled.

Quick start (recommended for most customers)

Attach the AWS managed policy ReadOnlyAccess to the IAM principal the CLI
will use. It exists in GovCloud and grants every read action used by the
RegScale CLI AWS commands. This is the lowest-friction path.

If your security posture requires least-privilege, build a custom policy from
the per-command sections below.

Baseline permissions (required by every command)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Baseline",
      "Effect": "Allow",
      "Action": ["sts:GetCallerIdentity"],
      "Resource": "*"
    }
  ]
}

init.yaml configuration:

awsAccessKeyId: AKIA...                # or use a profile
awsSecretAccessKey: ...
awsSessionToken: ...                   # optional (STS / SSO)
awsDefaultRegion: us-gov-west-1        # or us-gov-east-1

You can also use regscale aws auth login --profile <govcloud-profile> to use
a GovCloud-region profile from ~/.aws/credentials.

Per-command IAM permissions

sync_assets and inventory collect — full asset inventory

These commands enumerate resources across many AWS services. Every describe is
wrapped in error handling, so missing permissions for an individual service
produce warnings (not failures) and the inventory continues.

Easiest: use ReadOnlyAccess. Otherwise, the following actions are required to
cover the services the inventory collector touches in GovCloud:

ec2:Describe*
lambda:List*, lambda:Get*
ecs:Describe*, ecs:List*
batch:Describe*
elasticbeanstalk:Describe*, elasticbeanstalk:ListTagsForResource

s3:ListAllMyBuckets, s3:GetBucket*
elasticfilesystem:Describe*
fsx:Describe*
storagegateway:List*, storagegateway:Describe*
backup:List*, backup:Get*

rds:Describe*
dynamodb:List*, dynamodb:Describe*
elasticache:Describe*
neptune:Describe*
docdb:Describe*
redshift:Describe*
timestream:Describe*, timestream:List*

elasticloadbalancing:Describe*
cloudfront:List*, cloudfront:Get*
route53:List*, route53:Get*
directconnect:Describe*
network-firewall:List*, network-firewall:Describe*
route53resolver:List*, route53resolver:Get*

iam:List*, iam:Get*
kms:List*, kms:Describe*
secretsmanager:List*, secretsmanager:Describe*
wafv2:List*, wafv2:Get*
acm:List*, acm:Describe*

elasticmapreduce:List*, elasticmapreduce:Describe*
kinesis:List*, kinesis:Describe*
firehose:List*, firehose:Describe*
glue:Get*, glue:List*
athena:List*, athena:Get*
kafka:List*, kafka:Describe*

sagemaker:List*, sagemaker:Describe*

codepipeline:List*, codepipeline:Get*
codebuild:List*, codebuild:BatchGet*
codedeploy:List*, codedeploy:Get*
codecommit:List*, codecommit:Get*

states:List*, states:Describe*
appsync:List*, appsync:Get*
workspaces:Describe*
iot:List*, iot:Describe*

apigateway:GET
sns:List*
sqs:List*
events:List*

ecr:Describe*
ssm:Describe*, ssm:List*, ssm:Get*

Some inventory targets (App Runner, Global Accelerator, Lightsail, Rekognition,
Comprehend, QLDB, Keyspaces) are not currently available in GovCloud. The CLI
catches the EndpointConnectionError / UnknownServiceError and continues —
do not add those actions.

sync_iam

iam:ListUsers
iam:GetUser
iam:ListMFADevices
iam:ListAccessKeys
iam:GetAccessKeyLastUsed
iam:GetLoginProfile
iam:ListUserPolicies
iam:ListAttachedUserPolicies
iam:ListGroups
iam:GetGroup
iam:ListRoles
iam:GetRole
iam:ListPolicies
iam:GetPolicy
iam:GetPolicyVersion
iam:GetAccountPasswordPolicy
iam:GetAccountSummary

sync_kms

kms:ListKeys
kms:DescribeKey
kms:GetKeyRotationStatus
kms:GetKeyPolicy
kms:ListGrants
kms:ListAliases
kms:ListResourceTags

sync_s3

s3:ListAllMyBuckets
s3:GetBucketLocation
s3:GetBucketVersioning
s3:GetBucketLogging
s3:GetBucketTagging
s3:GetBucketEncryption
s3:GetBucketPublicAccessBlock
s3:GetBucketAcl
s3:GetBucketPolicy
s3:GetBucketPolicyStatus

sync_cloudtrail

cloudtrail:DescribeTrails
cloudtrail:GetTrailStatus
cloudtrail:GetEventSelectors
cloudtrail:ListTags
cloudtrail:GetInsightSelectors
cloudtrail:LookupEvents

sync_cloudwatch and sync_cloudwatch_ex

logs:DescribeLogGroups
logs:ListTagsForResource
logs:DescribeMetricFilters
logs:DescribeSubscriptionFilters
logs:FilterLogEvents      # sync_cloudwatch_ex only
logs:GetLogEvents         # sync_cloudwatch_ex only

sync_ssm

ssm:DescribeInstanceInformation
ssm:DescribeInstancePatches
ssm:DescribePatchBaselines
ssm:GetPatchBaseline
ssm:DescribeParameters
ssm:GetParameter
ssm:DescribeDocument
ssm:ListDocuments
ssm:DescribeAssociation
ssm:ListAssociations
ssm:DescribeMaintenanceWindows
ssm:GetMaintenanceWindow
ssm:DescribeInstancePatchStates
ssm:ListComplianceItems
ssm:ListResourceComplianceSummaries

sync_ecr

ecr:DescribeRepositories
ecr:DescribeImages
ecr:DescribeImageScanFindings
ecr:GetRepositoryPolicy
ecr:ListTagsForResource
ecr:GetLifecyclePolicy

sync_org (run from the Organizations management account)

organizations:DescribeOrganization
organizations:ListAccounts
organizations:ListOrganizationalUnitsForParent
organizations:ListPolicies
organizations:DescribePolicy
organizations:ListPoliciesForTarget
organizations:ListTargetsForPolicy
organizations:DescribeAccount

sync_guardduty

guardduty:ListDetectors
guardduty:GetDetector
guardduty:ListFindings
guardduty:GetFindings
guardduty:GetFindingStatistics

sync_inspector and inspector import_scans

inspector2:ListFindings
inspector2:ListCoverage
inspector2:BatchGetAccountStatus
inspector2:GetConfiguration

Inspector v2 must be enabled in the GovCloud account before this command
returns findings.

sync_directory_services

ds:DescribeDirectories
ds:ListTagsForResource
ds:DescribeTrusts
ds:DescribeLDAPSSettings
ds:DescribeEventTopics

sync_ec2

ec2:Describe*

sync_config_compliance

config:DescribeConfigRules
config:DescribeComplianceByConfigRule
config:GetComplianceDetailsByConfigRule
config:DescribeConformancePacks
config:DescribeConformancePackCompliance
config:GetConformancePackComplianceDetails

AWS Config must have a configuration recorder running and at least one rule
or conformance pack deployed.

sync_compliance (Audit Manager)

auditmanager:ListAssessments
auditmanager:GetAssessment
auditmanager:GetAssessmentFramework
auditmanager:ListAssessmentFrameworks
auditmanager:GetEvidenceFoldersByAssessmentControl
auditmanager:GetEvidenceByEvidenceFolder

Audit Manager is GovCloud-supported. If your account has not yet enabled or
approved Audit Manager, skip this command and use sync_config_compliance
instead.

sync_findings / sync_findings_and_assets (Security Hub)

securityhub:GetFindings
securityhub:BatchImportFindings
guardduty:ListDetectors
guardduty:GetFindings
cloudtrail:LookupEvents
inspector2:ListFindings

Security Hub is GovCloud-supported. If your account has not yet enabled or
approved Security Hub, skip these commands and use sync_guardduty,
sync_inspector, and sync_cloudtrail as alternative finding sources.

Setup checklist

  1. Confirm the GovCloud account ID (separate from any commercial AWS account).
  2. Decide on the principal type:
    • IAM user with access keys for batch / scripted runs.
    • IAM role assumed via STS for cross-account or short-lived access.
    • IAM Identity Center for human operators with SSO.
  3. Attach ReadOnlyAccess (recommended) or a custom least-privilege policy
    built from the sections above.
  4. Configure RegScale CLI:
    • Edit init.yaml with awsAccessKeyId / awsSecretAccessKey /
      awsSessionToken / awsDefaultRegion: us-gov-west-1, or
    • Run regscale aws auth login --profile <govcloud-profile> against a
      profile in ~/.aws/credentials.
  5. Smoke test (no writes to RegScale): 
    regscale aws inventory collect --regions us-gov-west-1 --output /tmp/inv.json
  6. Run only the sync commands the customer has approved services for. Defer
    sync_findings* and sync_compliance until Security Hub / Audit Manager
    are enabled in the account if they are not already.

Cross-account assume-role (optional)

If RegScale CLI runs in account A and reads from account B, the role trust
policy in account B must reference the GovCloud partition:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws-us-gov:iam::<account-A>:role/regscale-cli-runner"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Attach the ReadOnlyAccess (or custom least-privilege) policy to the assumed
role in account B. The CLI handles sts:AssumeRole via the standard AWS SDK
credential chain.

Troubleshooting

  • InvalidClientTokenId / SignatureDoesNotMatch: keys belong to a
    commercial AWS account, not GovCloud. GovCloud requires GovCloud-native
    credentials.
  • AccessDenied on a single service: re-check the per-command section above
    and confirm the action and resource scope.
  • Empty results: verify the service is enabled in the account (e.g.
    GuardDuty detector, Inspector v2 enablement, Config recorder).
  • EndpointConnectionError: the service is not available in the chosen
    GovCloud region. Try the other GovCloud region (us-gov-east-1 ↔
    us-gov-west-1).

Reference links

Always cross-check the AWS Regional Services List
at the time of deployment — service availability changes over time.

Updated about 22 hours ago

Did this page help you?