Connect AWS for Workload Discovery and Enforcement

Introduction

Elisity Cloud Control Center (CCC) supports connectivity to Amazon Web Services (AWS) as a cloud workload connector, enabling discovery and visibility of EC2 instances within IdentityGraph. This extends Elisity's identity-based microsegmentation from on-premises network devices to cloud workloads, allowing administrators to manage both traditional endpoints and cloud instances under a unified policy framework.

The AWS connector discovers EC2 instances across selected AWS regions and imports their metadata into IdentityGraph. This gives administrators unified visibility into cloud workloads alongside traditional endpoints, with instance attributes, AWS account and network names, AWS tags, and per-interface network context available for review in IdentityGraph.

This article covers the following configuration workflow:

1. Enabling the Workloads feature in Advanced Settings
2. Configuring the AWS connector with IAM credentials and region selection
3. Assigning a Workload Distribution Zone to the AWS discovery endpoint
4. Viewing discovered workloads in IdentityGraph

Prerequisites

• Administrator access to Elisity Cloud Control Center
• A Workload Distribution Zone for the AWS discovery endpoint, or permission to create Distribution Zones
• An AWS IAM user with programmatic access (Access Key ID and Secret Access Key) and read permissions for EC2 across the target regions
• Alternatively, an IAM role that Elisity can assume, with read permissions for EC2 across the target regions. This method stores no long-lived credentials in Cloud Control Center and is recommended for production environments.
• The IAM user or role must have the permissions listed in Required AWS Permissions
• At least one active EC2 instance in the target AWS account for discovery validation

Required AWS Permissions

The permissions policy that Cloud Control Center displays during connector setup grants the following read-only permissions on all resources. The policy does not create, modify, or delete anything in AWS.

Enable the Workloads Feature

Step 1. Enable Workloads under Settings > System > Advanced. The Amazon Web Services connector is available only after Workloads is enabled. See Enable Workloads.

Configure the AWS Connector

After enabling Workloads, configure the AWS connector to establish connectivity to your AWS account and begin discovering EC2 instances.

Step 2. Open the Add Connector Dialog

Navigate to IdentityGraph > Connectors and click + Add Connector.

Step 3. Select Amazon Web Services

In the Add Connector dialog, locate and select Amazon Web Services. This will only be visible after enabling Workloads in Step 1. Click Configure.

The connector configuration wizard opens with five steps: Authentication Type, Authentication Setup, AWS Regions, Workload Distribution Zone, and Summary.

Step 4. Configure Authentication

On the Authentication Type step, enter a Connector Name and choose how Elisity authenticates to your AWS account:

• IAM Role Assumption - Elisity assumes a read-only role in your AWS account. No credentials are stored in Cloud Control Center. This method is marked Recommended and is the preferred option for production environments.
• IAM Access Keys - Elisity authenticates with an IAM user's access keys. Setup is simpler, but the access keys must be rotated manually.

Select the authentication method and click Next.

Authentication Setup

The Authentication Setup step presents the fields for the method selected on the Authentication Type step.

IAM Role Assumption

When IAM Role Assumption is selected, Cloud Control Center guides you through four steps to create and connect the role in your AWS account.

Step 1: Create IAM Policy in AWS

In the AWS Console, go to IAM > Policies > Create Policy, switch to the JSON editor, and paste the permissions policy displayed by Cloud Control Center. The policy grants the permissions listed in Required AWS Permissions. Name the policy ElisityCloudDiscoveryPolicy, then click I've Created The Policy.

In the AWS IAM console, the created policy lists the allowed services and access levels for the granted permissions.

Step 2: Create an IAM Role in AWS

In the AWS Console, go to IAM > Roles > Create Role and complete the following:

1. Select AWS account as the trusted entity type.
2. Choose Another AWS account and enter the Account ID provided by Cloud Control Center.
3. Select Require external ID and enter the External ID provided by Cloud Control Center.
4. Attach the ElisityCloudDiscoveryPolicy created in the previous step.
5. Give the role a name that begins with ElisityDiscoveryRole.

Use the Copy buttons in Cloud Control Center to copy the Account ID and External ID exactly, then click I've Created The Role.

While creating the role in AWS, attach the ElisityCloudDiscoveryPolicy when prompted to add permissions.

After the role is created, the AWS console displays the role summary with the attached ElisityCloudDiscoveryPolicy.

Step 3: Verify Trust Policy

The trust policy is configured automatically when you create the role. Cloud Control Center displays the expected trust policy so you can confirm it matches the one on your role, including the sts:AssumeRole action and the External ID condition. After confirming, click Looks Good.

Step 4: Enter Role ARN and Test

Copy the Role ARN from the role you created in AWS, paste it into the Role ARN field, and click Test Connection. When the role is validated, Cloud Control Center confirms that your AWS credentials were validated and you can proceed to the next step.

IAM Access Keys

When IAM Access Keys is selected, enter the Access Key ID and Secret Access Key for the IAM user, then click Test Connection to validate the credentials against the AWS API. This step also displays the read-only permissions policy that the IAM user requires. You can switch to IAM Role Assumption at any time from this step.

The Authentication Setup step for IAM Access Keys requires the following fields:

Step 5. Select AWS Regions

On the AWS Regions step, choose which AWS regions to scan for EC2 instances. Two options are available:

• All Regions - Scans all available AWS regions (17 regions). When selected, Cloud Control Center validates API access to every region during the permissions check. If the IAM credentials do not have access to all regions, Cloud Control Center automatically switches the selection to Custom and pre-selects only the regions where permissions were successfully validated.
• Custom - Select specific regions to scan (for example, us-east-1, us-east-2, us-west-1, us-west-2). Use this option to limit discovery to regions where your workloads reside or where the IAM user has permissions.

Select the appropriate option and, if using Custom, add the target regions to the Regions field.

After selecting the regions, click Validate Permissions to verify that the IAM credentials have API access to the selected regions. A success message confirms: "All regions verified successfully. You're ready to proceed with your workload setup." Click Next.

If you change the region selection afterwards, click Re-Validate to check the updated list.

Step 6. Assign a Workload Distribution Zone

On the Workload Distribution Zone step, select the Distribution Zone for this discovery endpoint from the list. A zone is required, and only Distribution Zones of type Workload are listed. The selected zone receives the policy mappings for the workloads this endpoint discovers. See Distribution Zones and Workloads.

If the zone does not exist yet, create it from the same list. Type a name for the new zone in the Workload Distribution Zone field, then click Create Workload Distribution Zone at the bottom of the list.

The Create Distribution Zone dialog opens with the typed name filled in as the Distribution Zone Name. The Distribution Zone Type is fixed to Workload. Optionally enter a Description, then click Create.

Cloud Control Center confirms that the Distribution Zone was created, and values entered on earlier steps are kept. The Workload Distribution Zone field shows a loading indicator while the new zone is registered with IdentityGraph, then selects the zone automatically. Next is unavailable until the zone is selected.

If registration takes longer than usual, a message below the field reads The new Workload Distribution Zone is still being registered. Refresh to look for it again. Click Refresh.

The Create Workload Distribution Zone action is shown only to users with permission to create Distribution Zones. Distribution Zones can also be created under Edge Management > Distribution Zones.

Click Next.

Step 7. Review and Submit

On the Summary step, review the connector configuration including the Authentication details (Connector Name, Authentication Method, and masked Access Key ID), the number of selected AWS Regions, and the Workload Distribution Zone. Click Submit to create the connector.

When the connector uses IAM Role Assumption, the Authentication details show the assumed Role ARN in place of the Access Key ID.

After submission, the connector appears on the Connectors page with an Active status. Cloud Control Center begins discovering EC2 instances across the configured regions. The initial discovery completes within approximately 60 seconds, and subsequent discovery cycles run at the same interval.

Use the row actions menu on the connector endpoint to edit, sync, or delete it.

View Discovered Workloads

Step 8. Navigate to IdentityGraph > Workloads. After the connector's first discovery cycle, the EC2 instances in the configured regions are listed with their AWS account ID and account name, VPC and subnet names, and the AWS tags on each instance and network interface. Account Name is empty when the account has no alias or the connector lacks the iam:ListAccountAliases permission; see Required AWS Permissions.

For the Workloads page, workload details, editing, classification and the Enforcement IP, see Workloads. For setting the Enforcement IP that policy is enforced on, see Enforcement IP.

Operationalization

Connector Status

After configuring the AWS connector, verify its status by navigating to IdentityGraph > Connectors. The Amazon Web Services connector should display an Active status, indicating that Cloud Control Center is successfully communicating with the AWS API and discovering EC2 instances at the configured interval.

Verification

To confirm that the Cloud Workloads integration is functioning correctly:

1. Navigate to IdentityGraph > Workloads and verify that EC2 instances from the configured regions appear in the workload list.
2. Click on an individual workload to confirm that Instance Details, CSP Tags, and other metadata are populated.
3. Open the Network Interfaces tab on the workload and confirm that the per-interface details are populated.
4. If applicable, verify that tag changes made in the AWS console are reflected in Cloud Control Center within approximately 60 seconds.
5. Filter the Account ID column by your AWS account ID and confirm that the instances from the connected account appear in the table.

Troubleshooting