--- agentTools: projectIndex: https://regscale.readme.io/llms.txt --- # AWS GovCloud Setup & Permissions for RegScale CLI This guide documents the IAM permissions and configuration needed to run the RegScale CLI AWS integration (`regscale aws ...`) against an AWS GovCloud (US) account. It is broken down by command so a customer can grant only what they need. ## GovCloud platform notes * **Partition**: `aws-us-gov` (not `aws`). Resource ARNs and trust policies must\ use this partition. * **Regions**: `us-gov-west-1` and `us-gov-east-1`. * **Endpoints**: Resolved automatically by the AWS SDK when you set the region;\ no endpoint override is required in `init.yaml`. * **IAM Identity Center / SSO**: GovCloud has its own IDC instance. The\ `regscale aws auth login` flow works with GovCloud SSO start URLs. ### Service availability for the AWS commands shipped in RegScale CLI Per the AWS GovCloud service availability documentation, all services that\ RegScale CLI's AWS integration depends on are available in at least one\ GovCloud region: | RegScale CLI command | AWS service | GovCloud availability | | ------------------------------------------- | ----------------------------------------- | --------------------- | | `sync_assets`, `inventory collect` | EC2, S3, RDS, Lambda, ECS, IAM, KMS, etc. | Available | | `sync_iam` | IAM | Available | | `sync_kms` | KMS | Available | | `sync_s3` | S3 | Available | | `sync_cloudtrail` | CloudTrail | Available | | `sync_cloudwatch`, `sync_cloudwatch_ex` | CloudWatch Logs | Available | | `sync_ssm` | Systems Manager | Available | | `sync_ecr` | ECR | Available | | `sync_org` | Organizations | Available | | `sync_guardduty` | GuardDuty | Available | | `sync_inspector`, `inspector import_scans` | Inspector v2 | Available | | `sync_directory_services` | Directory Service | Available | | `sync_ec2` | EC2 | Available | | `sync_config_compliance` | AWS Config | Available | | `sync_compliance` | Audit Manager | Available | | `sync_findings`, `sync_findings_and_assets` | Security Hub | Available | > **Approval status**: Every service listed above is present on the AWS\ > GovCloud services page, which means AWS has authorized it for use in\ > GovCloud (FedRAMP High at minimum; many services also DoD CC SRG\ > IL2/IL4/IL5 and ITAR). If a service is in GovCloud, it is approved for\ > GovCloud workloads — there is no further AWS-side gate. > > The remaining gates are customer-side, not AWS-side: > > 1. Has the customer **enabled** the service in their account\ > (Security Hub, GuardDuty detector, Inspector v2 enablement, Config\ > recorder, etc.)? Check the AWS console for that account. > 2. Does the service's impact level meet the workload's ATO requirement\ > (FedRAMP High vs DoD IL5)? Verify on the\ > [GovCloud services page](https://aws.amazon.com/govcloud-us/details/services/). > > If a service is approved+available but not yet *enabled*, the corresponding\ > RegScale CLI command will return empty results until enablement. Use\ > `sync_config_compliance` (AWS Config) as a compliance alternative if Audit\ > Manager isn't enabled, and `sync_guardduty` / `sync_inspector` /\ > `sync_cloudtrail` as findings alternatives if Security Hub isn't enabled. *** ## Quick start (recommended for most customers) Attach the AWS managed policy **`ReadOnlyAccess`** to the IAM principal the CLI\ will use. It exists in GovCloud and grants every read action used by the\ RegScale CLI AWS commands. This is the lowest-friction path. If your security posture requires least-privilege, build a custom policy from\ the per-command sections below. *** ## Baseline permissions (required by every command) ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "Baseline", "Effect": "Allow", "Action": ["sts:GetCallerIdentity"], "Resource": "*" } ] } ``` `init.yaml` configuration: ```yaml awsAccessKeyId: AKIA... # or use a profile awsSecretAccessKey: ... awsSessionToken: ... # optional (STS / SSO) awsDefaultRegion: us-gov-west-1 # or us-gov-east-1 ``` You can also use `regscale aws auth login --profile ` to use\ a GovCloud-region profile from `~/.aws/credentials`. *** ## Per-command IAM permissions ### `sync_assets` and `inventory collect` — full asset inventory These commands enumerate resources across many AWS services. Every describe is\ wrapped in error handling, so missing permissions for an individual service\ produce warnings (not failures) and the inventory continues. Easiest: use `ReadOnlyAccess`. Otherwise, the following actions are required to\ cover the services the inventory collector touches in GovCloud: ``` ec2:Describe* lambda:List*, lambda:Get* ecs:Describe*, ecs:List* batch:Describe* elasticbeanstalk:Describe*, elasticbeanstalk:ListTagsForResource s3:ListAllMyBuckets, s3:GetBucket* elasticfilesystem:Describe* fsx:Describe* storagegateway:List*, storagegateway:Describe* backup:List*, backup:Get* rds:Describe* dynamodb:List*, dynamodb:Describe* elasticache:Describe* neptune:Describe* docdb:Describe* redshift:Describe* timestream:Describe*, timestream:List* elasticloadbalancing:Describe* cloudfront:List*, cloudfront:Get* route53:List*, route53:Get* directconnect:Describe* network-firewall:List*, network-firewall:Describe* route53resolver:List*, route53resolver:Get* iam:List*, iam:Get* kms:List*, kms:Describe* secretsmanager:List*, secretsmanager:Describe* wafv2:List*, wafv2:Get* acm:List*, acm:Describe* elasticmapreduce:List*, elasticmapreduce:Describe* kinesis:List*, kinesis:Describe* firehose:List*, firehose:Describe* glue:Get*, glue:List* athena:List*, athena:Get* kafka:List*, kafka:Describe* sagemaker:List*, sagemaker:Describe* codepipeline:List*, codepipeline:Get* codebuild:List*, codebuild:BatchGet* codedeploy:List*, codedeploy:Get* codecommit:List*, codecommit:Get* states:List*, states:Describe* appsync:List*, appsync:Get* workspaces:Describe* iot:List*, iot:Describe* apigateway:GET sns:List* sqs:List* events:List* ecr:Describe* ssm:Describe*, ssm:List*, ssm:Get* ``` Some inventory targets (App Runner, Global Accelerator, Lightsail, Rekognition,\ Comprehend, QLDB, Keyspaces) are not currently available in GovCloud. The CLI\ catches the `EndpointConnectionError` / `UnknownServiceError` and continues —\ do not add those actions. *** ### `sync_iam` ``` iam:ListUsers iam:GetUser iam:ListMFADevices iam:ListAccessKeys iam:GetAccessKeyLastUsed iam:GetLoginProfile iam:ListUserPolicies iam:ListAttachedUserPolicies iam:ListGroups iam:GetGroup iam:ListRoles iam:GetRole iam:ListPolicies iam:GetPolicy iam:GetPolicyVersion iam:GetAccountPasswordPolicy iam:GetAccountSummary ``` ### `sync_kms` ``` kms:ListKeys kms:DescribeKey kms:GetKeyRotationStatus kms:GetKeyPolicy kms:ListGrants kms:ListAliases kms:ListResourceTags ``` ### `sync_s3` ``` s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketVersioning s3:GetBucketLogging s3:GetBucketTagging s3:GetBucketEncryption s3:GetBucketPublicAccessBlock s3:GetBucketAcl s3:GetBucketPolicy s3:GetBucketPolicyStatus ``` ### `sync_cloudtrail` ``` cloudtrail:DescribeTrails cloudtrail:GetTrailStatus cloudtrail:GetEventSelectors cloudtrail:ListTags cloudtrail:GetInsightSelectors cloudtrail:LookupEvents ``` ### `sync_cloudwatch` and `sync_cloudwatch_ex` ``` logs:DescribeLogGroups logs:ListTagsForResource logs:DescribeMetricFilters logs:DescribeSubscriptionFilters logs:FilterLogEvents # sync_cloudwatch_ex only logs:GetLogEvents # sync_cloudwatch_ex only ``` ### `sync_ssm` ``` ssm:DescribeInstanceInformation ssm:DescribeInstancePatches ssm:DescribePatchBaselines ssm:GetPatchBaseline ssm:DescribeParameters ssm:GetParameter ssm:DescribeDocument ssm:ListDocuments ssm:DescribeAssociation ssm:ListAssociations ssm:DescribeMaintenanceWindows ssm:GetMaintenanceWindow ssm:DescribeInstancePatchStates ssm:ListComplianceItems ssm:ListResourceComplianceSummaries ``` ### `sync_ecr` ``` ecr:DescribeRepositories ecr:DescribeImages ecr:DescribeImageScanFindings ecr:GetRepositoryPolicy ecr:ListTagsForResource ecr:GetLifecyclePolicy ``` ### `sync_org` (run from the Organizations management account) ``` organizations:DescribeOrganization organizations:ListAccounts organizations:ListOrganizationalUnitsForParent organizations:ListPolicies organizations:DescribePolicy organizations:ListPoliciesForTarget organizations:ListTargetsForPolicy organizations:DescribeAccount ``` ### `sync_guardduty` ``` guardduty:ListDetectors guardduty:GetDetector guardduty:ListFindings guardduty:GetFindings guardduty:GetFindingStatistics ``` ### `sync_inspector` and `inspector import_scans` ``` inspector2:ListFindings inspector2:ListCoverage inspector2:BatchGetAccountStatus inspector2:GetConfiguration ``` > Inspector v2 must be enabled in the GovCloud account before this command\ > returns findings. ### `sync_directory_services` ``` ds:DescribeDirectories ds:ListTagsForResource ds:DescribeTrusts ds:DescribeLDAPSSettings ds:DescribeEventTopics ``` ### `sync_ec2` ``` ec2:Describe* ``` ### `sync_config_compliance` ``` config:DescribeConfigRules config:DescribeComplianceByConfigRule config:GetComplianceDetailsByConfigRule config:DescribeConformancePacks config:DescribeConformancePackCompliance config:GetConformancePackComplianceDetails ``` > AWS Config must have a configuration recorder running and at least one rule\ > or conformance pack deployed. ### `sync_compliance` (Audit Manager) ``` auditmanager:ListAssessments auditmanager:GetAssessment auditmanager:GetAssessmentFramework auditmanager:ListAssessmentFrameworks auditmanager:GetEvidenceFoldersByAssessmentControl auditmanager:GetEvidenceByEvidenceFolder ``` > Audit Manager is GovCloud-supported. If your account has not yet enabled or\ > approved Audit Manager, skip this command and use `sync_config_compliance`\ > instead. ### `sync_findings` / `sync_findings_and_assets` (Security Hub) ``` securityhub:GetFindings securityhub:BatchImportFindings guardduty:ListDetectors guardduty:GetFindings cloudtrail:LookupEvents inspector2:ListFindings ``` > Security Hub is GovCloud-supported. If your account has not yet enabled or\ > approved Security Hub, skip these commands and use `sync_guardduty`,\ > `sync_inspector`, and `sync_cloudtrail` as alternative finding sources. *** ## Setup checklist 1. Confirm the GovCloud account ID (separate from any commercial AWS account). 2. Decide on the principal type: * **IAM user with access keys** for batch / scripted runs. * **IAM role assumed via STS** for cross-account or short-lived access. * **IAM Identity Center** for human operators with SSO. 3. Attach `ReadOnlyAccess` (recommended) or a custom least-privilege policy\ built from the sections above. 4. Configure RegScale CLI: * Edit `init.yaml` with `awsAccessKeyId` / `awsSecretAccessKey` /\ `awsSessionToken` / `awsDefaultRegion: us-gov-west-1`, **or** * Run `regscale aws auth login --profile ` against a\ profile in `~/.aws/credentials`. 5. Smoke test (no writes to RegScale): ```bash regscale aws inventory collect --regions us-gov-west-1 --output /tmp/inv.json ``` 6. Run only the sync commands the customer has approved services for. Defer\ `sync_findings*` and `sync_compliance` until Security Hub / Audit Manager\ are enabled in the account if they are not already. ## Cross-account assume-role (optional) If RegScale CLI runs in account A and reads from account B, the role trust\ policy in account B must reference the **GovCloud partition**: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws-us-gov:iam:::role/regscale-cli-runner" }, "Action": "sts:AssumeRole" } ] } ``` Attach the `ReadOnlyAccess` (or custom least-privilege) policy to the assumed\ role in account B. The CLI handles `sts:AssumeRole` via the standard AWS SDK\ credential chain. ## Troubleshooting * **`InvalidClientTokenId` / `SignatureDoesNotMatch`**: keys belong to a\ commercial AWS account, not GovCloud. GovCloud requires GovCloud-native\ credentials. * **`AccessDenied` on a single service**: re-check the per-command section above\ and confirm the action and resource scope. * **Empty results**: verify the service is enabled in the account (e.g.\ GuardDuty detector, Inspector v2 enablement, Config recorder). * **`EndpointConnectionError`**: the service is not available in the chosen\ GovCloud region. Try the other GovCloud region (`us-gov-east-1` ↔\ `us-gov-west-1`).
## Reference links * AWS GovCloud (US) User Guide: * AWS GovCloud (US) services available: * AWS GovCloud (US) endpoints (per service): * AWS Regional Services List (cross-region service availability): * AWS GovCloud ARN partition reference: * Service-specific GovCloud pages (relevant to this CLI): * Security Hub: * Audit Manager: * GuardDuty: * Inspector v2: * AWS Config: * CloudTrail: * CloudWatch Logs: * EC2: * IAM: * KMS: * S3: * Systems Manager (SSM): * ECR: * Organizations: * Directory Service: > Always cross-check the [AWS Regional Services List](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/)\ > at the time of deployment — service availability changes over time.