Introduction

This document provides the step-by-step procedure to configure AWS via ElectricEye in SAFE.

The SAFE integration with AWS enables the onboarding of AWS accounts into SAFE and allows the retrieval of assets and their security misconfigurations through ElectricEye.

Add AWS Account

SAFE allows users to add Individual Accounts and Member Accounts.

Add Individual Account in SAFE

SAFE admins can onboard an Individual AWS Account in SAFE via the Role method.

1. Navigate to Integrations and search for the “AWS via ElectricEye” card.

2. Click the AWS via ElectricEye Card.

3. On the configuration window, perform the configuration steps.

4. Click the AWS Security Hub card.

5. (Optional) If required, set the expiry date for the link as follows:

6. Mark the checkbox to Set the expiry date and time for the generated link.

7. Enter or select the expiry date and time from the calendar.

8. Click the Generate button.

9. The system generates a CloudFormation stack link. You can copy and paste the link into a new tab in the browser. The link redirects you to the AWS console page.

10. If asked by the system, log in to your AWS account that you want to onboard - by default it will try to onboard the already logged in AWS account.

11. The system displays a pre-filled Quick create stack page.

12. (Optional) If necessary, add the Permission Boundary ARN. SAFE supports adding the Permission Boundary ARN via an input text box in the quick create stack page to allow attaching the permission boundary to the IAM role (that is created as part of the stack).

13. Mark the checkbox to acknowledge that AWS CloudFormation might create IAM resources with custom names.
    Note: The CloudFormation template creates an IAM role and assigns read-only privileges to it. This access privilege is then used by SAFE during the automated/on-demand assessment of all supported services available under that cloud account.

14. Click the Create stack button. The system might take a few minutes to create the stack, usually between 3 to 5 minutes.
    Note: If the user has previous onboarded the same account on same tenant, the user will require to delete the existing stack before creating the new stack to onboard the AWS account again.

15. SAFE auto-discovers your AWS account and displays it under Configured Accounts.

Manage AWS Accounts

View AWS Account

To view the onboarded AWS account:

1. Navigate to AWS via the ElectricEye integration page.

2. The system displays a list of all the configured accounts on the page.

View sync history for the AWS Account

To view the sync history of individual accounts, click on the Account ID in the “Configured Account” section. The page will display the sync history for the account.

Manually Sync AWS Account

To start a manual sync:

1. Navigate to the integration configuration page.

2. Click the options menu available in the Manage column.

3. Click the sync button. The system notifies you that a sync has been started. The status of the sync will be displayed under the “Assessment Status” column.

4. To sync AWS accounts in bulk, select the AWS accounts by marking the checkboxes available against them.

5. Click the Sync icon available at the top to start the sync.

Delete AWS Account

To delete multiple AWS accounts:

1. In the section for Configured Accounts, select the AWS accounts by marking the checkboxes available against them.

2. Click the Delete option from the top menu.

3. Click the “Yes, Delete” button on the confirmation screen.

4. AWS account can also be deleted individually by choosing the delete option from the “Manage” column menu.

Note : The CloudFormation stack created for the onboarded account must be deleted manually in the AWS account itself to support onboarding the same account in the future.

Set Global Sync Frequency for onboarded AWS accounts

Users can set Global Sync Frequency (frequency for syncing the onboarded AWS account as a number of days).

To set the auto-sync frequency for onboarded AWS accounts:

1. In the section for Configured Accounts, click on the setting icon at the top.

2. Enter the number of days in the Global Sync Frequency field.

3. Click the Update button.

View Results

SAFE syncs the added AWS accounts and automatically onboard the assets in SAFE.

1. Go to the AWS integration page.

2. Click the Asset View” tab to see all the AWS assets .

3. Click the “Finding View” tab to see all the findings.

FAQs

I can’t see all Security Findings in SAFE. Why?

Currently, SAFE supports configuration findings only from AWS Security Hub.

The following finding types are ingested into SAFE:

• Software and Configuration Checks / Industry and Regulatory Standards

• Effects* – All finding types starting with “Effects”

• Software and Configuration Checks / AWS Security Best Practices / External Access Granted

• Software and Configuration Checks

If I pause or stop an EC2 instance, will SAFE still assess it?

Yes. SAFE continues to assess onboarded assets regardless of their runtime state, as long as the AWS account is regularly synced.

If I set an expiry date for a stack-creation link (e.g., 7th Apr 2021), when will it become inactive?

The link becomes inactive from 12:00 AM on 8th Apr 2021.

What happens if I use the stack-creation link after it has expired?

The stack can still be created using the link, but the associated AWS account will not appear in SAFE.

What if I create another stack in an account that already has one?

• You can deploy multiple stacks in the same AWS account only if they are linked to different SAFE instances.

• If you attempt to create another stack for the same SAFE instance, the stack creation will fail.

Resolution:

Delete the previous stack before deploying the new one.

• Once deleted, the account will no longer be assessed in SAFE until the new stack is deployed.

• If the next scheduled sync occurs before deploying the new stack, the assessment status will show as Failed.

What happens if I delete an AWS account from SAFE while a sync is in progress?

The ongoing sync will continue in the background, but the results will not be updated in SAFE.

Why is the Add Account button disabled even though I am logged in as an Admin?

Please contact the SAFE Support team to enable the "Add Account" button.

Why did SAFE opt to make use of Electric Eye in the AWS integration?

While designing a scalable and cost-effective security solution, we needed a tool that could assess AWS configurations without relying on paid services. While AWS Security Hub offers robust capabilities, it is a paid service, and not all customers choose to enable it due to cost considerations.

To address this, we evaluated free and open-source tools that provide cloud configuration assessments. After reviewing several options, we focused on ScoutSuite and ElectricEye, both widely used in the security community.

ElectricEye was ultimately selected over ScoutSuite due to several key advantages:

• It offers stronger alignment with industry-standard security frameworks such as CIS, NIST, PCI-DSS, and HIPAA.

• It provides more actionable findings and a broader set of AWS-specific controls.

Electric Eye looks to replicate security controls already present in AWS, what additional value is provided over a native AWS integration?

While it's true that ElectricEye evaluates configurations that already exist in AWS, its value lies in how it standardizes, and aligns those checks with recognised security frameworks. Here's how it adds meaningful value:

• Standards Mapping
  One of ElectricEye’s key strengths is its built-in mapping to compliance standards such as CIS Benchmarks, PCI-DSS, HIPAA, and NIST. While AWS provides raw configurations and findings (e.g., via Config, Trusted Advisor, or Security Hub), ElectricEye translates these into actionable, standards-aligned insights.

• Reporting and Visibility

  ElectricEye outputs findings in a structured format (e.g., JSON ), making it easy to aggregate, visualize for tracking and remediation.

• Reporting and Visibility

  It provides many of the same benefits as AWS Config or Security Hub at no extra cost, which is especially valuable for customers who want security visibility without incurring additional AWS service charges.

ElectricEye doesn’t just duplicate what AWS already provides—it enhances it by adding context, compliance mapping, and flexibility in a cost-effective way.

Is Electric Eye suitable for large-scale AWS environments?

At our end, we use Electric Eye in an optimized and efficient way to handle larger AWS accounts seamlessly. We rely on the IAM role automatically created during the CloudFormation stack deployment to streamline the process of generating temporary credentials. Once the IAM role is in place, we programmatically assume this role using AWS SDKs, which triggers the generation of temporary credentials through the AWS Security Token Service (STS). These credentials are short-lived, ensuring that we follow best security practices by avoiding long-lived access keys and minimizing exposure to potential risks.

We then process the Electric Eye reports auditor by auditor, breaking down the task into smaller, more manageable units. This ensures that smaller reports are generated, optimizing both performance and resource utilization. By handling each auditor individually, we can scale efficiently, allowing us to manage larger AWS accounts without any performance bottlenecks or issues.

Are AWS cost metrics available for the impact of a sync with SAFE?

Currently, we do not have specific metrics on the impact of syncing data from AWS to SAFE. However, Electric Eye retrieves metadata using AWS’s read-only calls such as Describe, List, and Get, typically through an assumed role in a cross-account setup. These API operations and the use of STS:AssumeRole do not incur additional AWS charges. As a result, we do not expect any significant AWS-side cost impact from this sync process.

Which commit/version of Electric Eye does SAFE use?

We are using Electric Eye at commit ID 092d151f90cc07a351f4758a39536ed501797dfc (refer to GitHub). Going forward, we plan to follow a six-month update cycle. If an upgrade is needed (for a new AWS service or a security patch), we will re-clone the project and check out the latest suitable commit. We’ve also raised a pull request for a bug we identified, which is pending approval and merge. Once merged, we’ll update to the latest commit.

Which auditors in Electric Eye does SAFE use?

We are skipping the following auditors:

• ElectricEye_AttackSurface_Auditor

• Amazon_CloudWatch_Auditor

Additionally, in the following auditors, we are skipping certain checks:

• Amazon_EBS_Auditor: Skipping ebs_snapshot_encryption_check and ebs_snapshot_public_check

• Amazon_RDS_Auditor: Skipping rds_snapshot_encryption_check and rds_snapshot_public_share_check

All other auditors are being used.

Which role/permissions and connectivity method does SAFE use?

We use AWS-managed read-only access with additional denial permissions to restrict unnecessary data exposure. The CloudFormation template for this role can be found here -

https://safe-ent-common-app-us.s3.amazonaws.com/public/onboarding/v2/SafeSecurityAwsOnboardingStack.template.json

We assume the role created through this CloudFormation template to generate temporary credentials for accessing AWS resources via electric eye.

Can a custom customer provided AWS role be used?

No, custom roles cannot be used.

What processes do you have in place to dispose of any residual data that you collect outside of that required for risk assessment?

Any data retrieved by Electric Eye auditors that isn’t required for the risk assessment is neither stored nor logged. It exists only temporarily in the memory of the ECS task. Once the sync is completed, the ECS task is stopped and deleted, ensuring data is disposed of properly.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.