> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS
> Integrate with AWS Guard Duty
Wirespeed uses the [AssumeRole API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html) to integrate into your AWS accounts.
## Integrating all accounts (recommended)
This method uses [AWS CloudFormation StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.html) to deploy the required integration permissions across all AWS organizations underneath your root account. It will also automatically deploy Wirespeed in any new AWS accounts you deploy.
We recommend you test deployment with a subset of accounts first to minimize errors. Copy our [CloudFormation Quick Link](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml\&stackName=Wirespeed-GuardDuty-Integration), login to your desired AWS console account, and navigate to the copied link to deploy to a single account.
### In Wirespeed
1. Navigate to Integrations > [Add Integration](https://app.wirespeed.co/settings/integrations?tab=browse) > AWS > Organization-wide
2. **Copy the API key** for use in **Step 2** below
### In AWS
Ensure all accounts you want to integrate with have Guard Duty enabled. If not, the integrations will be set to failed.
1. Log in to your root AWS account on the AWS console **as an Administrator**
2. Ensure [Trusted Access](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-activate-trusted-access.html) has been enabled for your account
3. Navigate to **CloudFormation** > **Stack Sets** > **Create Stack Set**
4. Continue with the steps below
#### Step 1
1. Permission Model > Service-Managed Permissions
2. Prepare Template > Template is ready
3. Specify Template > **Amazon S3 URL** > `https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml`
#### Step 2
1. Use a sensible name and description
2. Provide the **API key** you copied from the **Getting Started** > **In Wirespeed** step above
#### Step 3
1. Acknowledge the disclaimer
#### Step 4
1. Leave all defaults selected
2. Choose a single region to deploy in (IAM roles are global, so you only need to choose one)
#### Step 5
1. Click Submit
#### Step 6
1. This stack set does not include deployment to your root management account. To deploy to that account, login to the AWS console for your root account, navigate [here](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https%3A%2F%2Fs3.us-east-1.amazonaws.com%2Fcfn.wirespeed.co%2Ftemplate.yaml\&stackName=Wirespeed-GuardDuty-Integration) and follow the instructions.
Ensure the stack set deploys correctly across all accounts in your organization, address any errors as needed. Reach out to Wirespeed for assistance. Upon successful deployment, the accounts will show up in Wirespeed underneath [Integrations](https://app.wirespeed.co/settings/integrations)
This Cloudformation stack will deploy in all new accounts you make in your organization going forward.
## Integrating a single account
### Cloudformation (Option A)
1. Log into Wirespeed and navigate to Integrations > [**Add New Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select **AWS** from the dropdown
3. Select **Single Account (Auto)**
4. Copy the API key
5. Click [here](https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://s3.us-west-2.amazonaws.com/aws-deploy.wirespeed.co/deploy-template.yaml\&stackName=Wirespeed-GuardDuty-Integration) to deploy a CloudFormation stack
6. Follow all instructions and default options
Upon completion you will see the account added on the Wirespeed [Integrations](https://app.wirespeed.co/settings/integrations) page.
### Manual (Option B)
1. Log in to your AWS console and open the **IAM** page.
2. Go to **Access Management** > **Roles**.
3. Click **Create Role**.
4. Under **Trusted Entity Type**, select **AWS Account**.
5. Check **Require External ID** and enter a secure, randomly generated password.
a. Be sure to save this information, as you'll need it later to add the account in Wirespeed.
b\*\*. Note: AWS \*\*requires that the External ID match the regular expression `^[\w+=,.@:/-]*$`.
6. Choose **Another AWS Account** and enter the ID `590183894387`.
7. Select **Next** to advance to the **Add Permissions** page.
8. Open a new tab in IAM and go to the **Policies** page. Select **Create Policy**.
9. In the newly opened browser window, paste the following JSON template:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"ec2:DescribeRegions",
"guardduty:EnableOrganizationAdminAccount",
"guardduty:DeleteMalwareProtectionPlan",
"guardduty:ListThreatIntelSets",
"guardduty:GetThreatIntelSet",
"guardduty:CreateDetector",
"guardduty:DisassociateMembers",
"guardduty:DescribeMalwareScans",
"guardduty:UpdateMemberDetectors",
"guardduty:GetAdministratorAccount",
"guardduty:GetDetector",
"guardduty:AcceptInvitation",
"guardduty:GetRemainingFreeTrialDays",
"guardduty:UpdateMalwareScanSettings",
"guardduty:ListInvitations",
"guardduty:DisassociateFromAdministratorAccount",
"guardduty:UpdateMalwareProtectionPlan",
"guardduty:UnarchiveFindings",
"guardduty:GetMemberDetectors",
"guardduty:DeclineInvitations",
"guardduty:DeleteDetector",
"guardduty:ListPublishingDestinations",
"guardduty:GetFilter",
"guardduty:ListTagsForResource",
"guardduty:ListMembers",
"guardduty:ListIPSets",
"guardduty:ListCoverage",
"guardduty:CreateSampleFindings",
"guardduty:GetMasterAccount",
"guardduty:UpdateFindingsFeedback",
"guardduty:GetCoverageStatistics",
"guardduty:ListMalwareProtectionPlans",
"guardduty:GetMembers",
"guardduty:GetOrganizationStatistics",
"guardduty:UpdateFilter",
"guardduty:SendSecurityTelemetry",
"guardduty:CreateThreatIntelSet",
"guardduty:StopMonitoringMembers",
"guardduty:CreateMalwareProtectionPlan",
"guardduty:CreateFilter",
"guardduty:GetMalwareScanSettings",
"guardduty:DisableOrganizationAdminAccount",
"guardduty:ListFilters",
"guardduty:DeleteThreatIntelSet",
"guardduty:GetInvitationsCount",
"guardduty:GetFindings",
"guardduty:DeleteMembers",
"guardduty:DeleteIPSet",
"guardduty:DeleteFilter",
"guardduty:AcceptAdministratorInvitation",
"guardduty:DeletePublishingDestination",
"guardduty:ListFindings",
"guardduty:DisassociateFromMasterAccount",
"guardduty:DeleteInvitations",
"guardduty:DescribePublishingDestination",
"guardduty:GetMalwareProtectionPlan",
"guardduty:InviteMembers",
"guardduty:ListDetectors",
"guardduty:ArchiveFindings",
"guardduty:UpdateDetector",
"guardduty:GetIPSet",
"guardduty:StartMalwareScan",
"guardduty:UpdateOrganizationConfiguration",
"guardduty:StartMonitoringMembers",
"guardduty:GetUsageStatistics",
"guardduty:CreateMembers",
"guardduty:ListOrganizationAdminAccounts",
"guardduty:DescribeOrganizationConfiguration",
"guardduty:GetFindingsStatistics"
],
"Resource": "*"
}
]
}
```
10. Click **Next**, then enter a name for the policy and select **Create Policy**.
11. Go back to the role creation window, refresh the policy list, and check the box for the newly created policy.
12. Click **Next**.
13. Provide a name for the role, then review the **Trusted Entities** section. The trust policy should resemble the following:
```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::590183894387:root"
},
"Condition": {
"StringEquals": {
"sts:ExternalId": "[RANDOM_PASSWORD]"
}
}
}
]
}
```
14. Ensure that the newly created policy appears in the permissions section, then select "Create Role". Note the role ARN.
15. Log into Wirespeed and navigate to Integrations > [**Add New Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
16. Select **AWS** from the dropdown
17. Select **Single Account (Manual)**
18. Input the **Role ARN** and **External ID**
19. Click **Integrate**
On first sync, Wirespeed fetches GuardDuty findings updated in the last **90 days** (per detector and region).