Documentation

1. Purpose

This document describes the step-by-step procedure to configure AWS Identity and Access Management (IAM) so that the CBOM AWS Discovery Sensor can successfully discover:

AWS Certificate Manager (ACM) certificates
IAM Server Certificates
AWS KMS asymmetric keys (metadata only)

The procedure covers:

Creating a least-privilege IAM policy
Creating a dedicated IAM user
Generating access credentials (Access Key ID and Secret Access Key)
Verifying permissions

This guide uses AWS Management Console (GUI only) and does not require AWS CLI.

2. Prerequisites

Before starting, ensure:

You have access to the AWS Management Console
You are signed in as: Root user, or An IAM user with permissions to manage IAM (e.g., IAMFullAccess)
You have at least one AWS region enabled (e.g., us-east-1)

3. Create IAM Policy for AWS Discovery

3.1 Open IAM Service

Sign in to the AWS Management Console
In the search bar, type IAM
Click IAM to open the Identity and Access Management console

3.2 Create a New Policy

In the left navigation menu, click Policies
Click Create policy
Select the JSON tab

3.3 Define Discovery Permissions

Paste the following policy document exactly as shown:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AWSCertificateDiscovery",
			"Effect": "Allow",
			"Action": [
				"acm:ListCertificates",
				"acm:DescribeCertificate",
				"acm:DescribeCertificate",
				"iam:ListServerCertificates",
				"iam:GetServerCertificate",
				"iam:ListRoles",
				"iam:ListUsers",
				"iam:ListRolePolicies",
				"iam:ListUserPolicies",
				"iam:GetRolePolicy",
				"iam:GetUserPolicy",
				"iam:ListAttachedRolePolicies",
				"iam:ListAttachedUserPolicies",
				"iam:GetPolicy",
				"iam:GetPolicyVersion",
				"kms:ListKeys",
				"kms:ListAliases",
				"kms:DescribeKey",
				"kms:GetPublicKey",
				"kms:ListResourceTags"
			],
			"Resource": "*"
		}
	]
}

This policy grants read-only access required for discovery.

Click Next

3.4 Name and Create Policy

Policy name: CBOM-AWS-Certificate-Discovery
Description: Read-only access for CBOM AWS certificate and key discovery

Click Create policy

4. Create Dedicated IAM User

4.1 Create User

In the IAM console, click Users
Click Create user

4.2 Configure User Details

User name: cbom-aws-discovery

Click Next

4.3 Attach Permissions

Select Attach policies directly
Search for CBOM-AWS-Certificate-Discovery
Select the policy
Click Next

4.4 Review and Create

Confirm:

Correct user name
Correct policy attached

Click Create user

5. Generate Access Credentials

5.1 Open User Security Credentials

In IAM → Users
Click the user cbom-aws-discovery
Open the Security credentials tab

5.2 Create Access Key

Scroll to Access keys
Click Create access key
Select Application running outside AWS
Click Next
(Optional) Skip tags
Click Create access key

5.3 Record Credentials

The following values will be displayed:

Access key ID
Secret access key

Actions required:

Download the .csv file or copy both values securely
Store credentials in a secure vault or password manager

Important:

The secret access key is displayed only once and cannot be retrieved later.

6. Verify IAM Configuration

6.1 Verify Policy Attachment

IAM → Users → cbom-aws-discovery
Open Permissions tab
Confirm: CBOM-AWS-Certificate-Discovery is attached No permission boundary is present

6.2 Verify No Explicit Deny

Click View summary
Ensure: No explicit deny statements exist IAM, ACM, and KMS actions show allowed permissions

7. Configure CBOM AWS Sensor

Use the generated credentials in the CBOM AWS discovery configuration:

aws_access_key_id: "<AWS_ACCESS_KEY_ID>"
aws_secret_access_key: "<AWS_SECRET_ACCESS_KEY>"
region: us-east-1
services:
    - acm
    - iam
    - kms
scan_name: AWSDiscovery

8. Validation

After configuration:

Run the AWS discovery task from CBOM
Confirm: Task completes successfully No AccessDenied errors appear * IAM Server Certificates are discovered (if present)

Verification in AWS:

IAM → User → Security credentials
Access key shows recent usage timestamp

9. Common Errors and Resolution

Error

AccessDenied: iam:ListServerCertificates

Cause

Policy not attached
Incorrect policy document
Permission boundary applied

Resolution

Re-check Sections 3, 4, and 6
Ensure correct policy is attached to the correct user

10. Security Recommendations (Optional)

For production environments:

Use IAM Roles with STS instead of long-term access keys
Restrict permissions further if IAM Server Certificates are not required
Rotate access keys periodically
Monitor CloudTrail for credential usage

11. Conclusion

Following this guide ensures that the CBOM AWS Discovery Sensor operates with:

Least privilege
Read-only access
Full compatibility with ACM, IAM, and KMS discovery workflows

CBOM Secure

AWS IAM Setup Guide for CBOM AWS Discovery Sensor