Configure Cloud Workloads for AWS

Introduction

Elisity Cloud Control Center (CCC) supports connectivity to Amazon Web Services (AWS) as a cloud workload connector, enabling discovery and visibility of EC2 instances within IdentityGraph. This extends Elisity's identity-based microsegmentation from on-premises network devices to cloud workloads, allowing administrators to manage both traditional endpoints and cloud instances under a unified policy framework.

The AWS connector discovers EC2 instances across selected AWS regions and imports their metadata into IdentityGraph. This gives administrators unified visibility into cloud workloads alongside traditional endpoints, with instance attributes, AWS account and network names, AWS tags, and per-interface network context available for review in IdentityGraph.

This article covers the following configuration workflow:

1. Enabling the Workloads feature in Advanced Settings
2. Configuring the AWS connector with IAM credentials and region selection
3. Assigning a Workload Distribution Zone to the AWS discovery endpoint
4. Viewing discovered workloads in IdentityGraph

Prerequisites

• Administrator access to Elisity Cloud Control Center
• An AWS IAM user with programmatic access (Access Key ID and Secret Access Key) and read permissions for EC2 across the target regions
• Alternatively, an IAM role that Elisity can assume, with read permissions for EC2 across the target regions. This method stores no long-lived credentials in Cloud Control Center and is recommended for production environments.
• The IAM user or role must have the permissions listed in Required AWS Permissions
• At least one active EC2 instance in the target AWS account for discovery validation

Required AWS Permissions

The permissions policy that Cloud Control Center displays during connector setup grants the following read-only permissions on all resources. The policy does not create, modify, or delete anything in AWS.

Enable the Workloads Feature

The Workloads capability is an advanced feature that must be enabled before the AWS connector and Workloads navigation become available.

Step 1. Enable Workloads in Advanced Settings

Navigate to Settings > System > Advanced. Locate the Workloads tile and toggle Enable Workloads to the on position.

After enabling Workloads, the left navigation updates. The IdentityGraph menu expands to display two sub-items: Devices and Workloads. The Connectors page also displays the Amazon Web Services connector option.

Configure the AWS Connector

After enabling Workloads, configure the AWS connector to establish connectivity to your AWS account and begin discovering EC2 instances.

Step 2. Open the Add Connector Dialog

Navigate to Settings > Connectors and click + Add Connector.

Step 3. Select Amazon Web Services

In the Add Connector dialog, locate and select Amazon Web Services. This will only be visible after enabling Workloads in Step 1. Click Configure.

The connector configuration wizard opens with four steps: Authentication Type, Authentication Setup, AWS Regions, and Summary.

Step 4. Configure Authentication

On the Authentication Type step, enter a Connector Name and choose how Elisity authenticates to your AWS account:

• IAM Role Assumption - Elisity assumes a read-only role in your AWS account. No credentials are stored in Cloud Control Center. This method is marked Recommended and is the preferred option for production environments.
• IAM Access Keys - Elisity authenticates with an IAM user's access keys. Setup is simpler, but the access keys must be rotated manually.

Select the authentication method and click Next.

Authentication Setup

The Authentication Setup step presents the fields for the method selected on the Authentication Type step.

IAM Role Assumption

When IAM Role Assumption is selected, Cloud Control Center guides you through four steps to create and connect the role in your AWS account.

Step 1: Create IAM Policy in AWS

In the AWS Console, go to IAM > Policies > Create Policy, switch to the JSON editor, and paste the permissions policy displayed by Cloud Control Center. The policy grants the permissions listed in Required AWS Permissions. Name the policy ElisityCloudDiscoveryPolicy, then click I've Created The Policy.

In the AWS IAM console, the created policy lists the allowed services and access levels for the granted permissions.

Step 2: Create an IAM Role in AWS

In the AWS Console, go to IAM > Roles > Create Role and complete the following:

1. Select AWS account as the trusted entity type.
2. Choose Another AWS account and enter the Account ID provided by Cloud Control Center.
3. Select Require external ID and enter the External ID provided by Cloud Control Center.
4. Attach the ElisityCloudDiscoveryPolicy created in the previous step.
5. Give the role a name that begins with ElisityDiscoveryRole.

Use the Copy buttons in Cloud Control Center to copy the Account ID and External ID exactly, then click I've Created The Role.

While creating the role in AWS, attach the ElisityCloudDiscoveryPolicy when prompted to add permissions.

After the role is created, the AWS console displays the role summary with the attached ElisityCloudDiscoveryPolicy.

Step 3: Verify Trust Policy

The trust policy is configured automatically when you create the role. Cloud Control Center displays the expected trust policy so you can confirm it matches the one on your role, including the sts:AssumeRole action and the External ID condition. After confirming, click Looks Good.

Step 4: Enter Role ARN and Test

Copy the Role ARN from the role you created in AWS, paste it into the Role ARN field, and click Test Connection. When the role is validated, Cloud Control Center confirms that your AWS credentials were validated and you can proceed to the next step.

IAM Access Keys

When IAM Access Keys is selected, enter the Access Key ID and Secret Access Key for the IAM user, then click Test Connection to validate the credentials against the AWS API. This step also displays the read-only permissions policy that the IAM user requires. You can switch to IAM Role Assumption at any time from this step.

The Authentication Setup step for IAM Access Keys requires the following fields:

Step 5. Select AWS Regions

On the AWS Regions step, choose which AWS regions to scan for EC2 instances. Two options are available:

• All Regions - Scans all available AWS regions (17 regions). When selected, Cloud Control Center validates API access to every region during the permissions check. If the IAM credentials do not have access to all regions, Cloud Control Center automatically switches the selection to Custom and pre-selects only the regions where permissions were successfully validated.
• Custom - Select specific regions to scan (for example, us-east-1, us-east-2, us-west-1, us-west-2). Use this option to limit discovery to regions where your workloads reside or where the IAM user has permissions.

Select the appropriate option and, if using Custom, add the target regions to the Regions field.

After selecting the regions, click Validate Permissions to verify that the IAM credentials have API access to the selected regions. A success message confirms: "All regions verified successfully. You're ready to proceed with your workload setup." Click Next.

If you change the region selection afterwards, click Re-Validate to check the updated list.

Step 6. Review and Submit

On the Summary step, review the connector configuration including the Authentication details (Connector Name, Authentication Method, and masked Access Key ID) and the number of selected AWS Regions. Click Submit to create the connector.

When the connector uses IAM Role Assumption, the Authentication details show the assumed Role ARN in place of the Access Key ID.

After submission, the connector appears on the Connectors page with an Active status. Cloud Control Center begins discovering EC2 instances across the configured regions. The initial discovery completes within approximately 60 seconds, and subsequent discovery cycles run at the same interval.

Use the row actions menu on the connector endpoint to edit, sync, or delete it.

View Discovered Workloads

After the AWS connector completes its initial discovery cycle, discovered EC2 instances appear in the Workloads section of IdentityGraph.

Step 7. Navigate to the Workloads Page

Navigate to IdentityGraph > Workloads. The Workloads page displays a summary dashboard and a searchable table of all discovered cloud workloads.

Workload Summary

The summary section at the top of the page provides an overview of discovered workloads including:

• Total Workloads - The total count of discovered EC2 instances
• By State - Color-coded indicators showing the number of running, stopped, and terminated instances
• By Region - A donut chart showing the distribution of workloads across AWS regions
• By Virtual Network - A donut chart showing the distribution of workloads across Virtual Private Clouds (VPCs)
• By Instance Type - A donut chart showing the distribution of workloads by EC2 instance type

Workload Table

The table below the summary lists each discovered workload with the following columns:

Account ID, Account Name, Virtual Network Name, and Subnet Name are visible by default and can be filtered and sorted like the other columns. Use Manage Columns in the table toolbar to show or hide columns. When a workload has interfaces in more than one VPC or subnet, the cell shows the first value and a +N indicator that opens the full list.

Step 8. View Workload Details

Click on any workload in the table to open its detail page. The Workload Details page displays three sections of information:

Instance Details

This section displays the authoritative metadata sourced directly from AWS. These fields are sourced from AWS and update automatically during each discovery cycle:

The workload also carries the Workload Distribution Zone of the AWS discovery endpoint that discovered it. The value is read-only on the workload and is changed by editing the endpoint.

Labels and Tags

This section displays two categories of metadata:

• CSP Tags - Tags applied to the EC2 instance in AWS (for example, Role: WebServer, Environment: Production, Application: CustomerPortal). These are read-only and synchronize automatically from AWS.
• Manually Configured Labels - Elisity-specific labels that administrators can manually assign to the workload for additional classification.

Manually Configured

This section contains fields that administrators can edit directly in Cloud Control Center:

• Hostname - A custom hostname for the workload
• Risk Level - An administrator-assigned risk level
• Risk Score - An administrator-assigned risk score

Network Interfaces

The Network Interfaces tab lists each network interface attached to the workload. A workload can have one or more interfaces, and each interface is modeled with its own network context and security data. For each interface, this tab displays:

• Enforcement IP - The IP address configured for policy enforcement on the interface, marked Auto-discovered when Cloud Control Center derived it from the interface rather than an administrator setting it
• Network Context - The interface MAC address, VPC ID and VPC Name, Subnet ID and Subnet Name, subnet CIDR, source/destination check state, and route table
• Security Groups - The AWS security groups associated with the interface
• CSP Interface Tags - Read-only tags applied to the interface in AWS
• Elisity Interface Tags - Tags that administrators can assign to the interface in Cloud Control Center

Operationalization

Connector Status

After configuring the AWS connector, verify its status by navigating to Settings > Connectors. The Amazon Web Services connector should display an Active status, indicating that Cloud Control Center is successfully communicating with the AWS API and discovering EC2 instances at the configured interval.

Verification

To confirm that the Cloud Workloads integration is functioning correctly:

1. Navigate to IdentityGraph > Workloads and verify that EC2 instances from the configured regions appear in the workload list.
2. Click on an individual workload to confirm that Instance Details, CSP Tags, and other metadata are populated.
3. Open the Network Interfaces tab on the workload and confirm that the per-interface details are populated.
4. If applicable, verify that tag changes made in the AWS console are reflected in Cloud Control Center within approximately 60 seconds.
5. Filter the Account ID column by your AWS account ID and confirm that the instances from the connected account appear in the table.

Troubleshooting