AWS

The AWS integration provides visibility into cloud infrastructure activity and enables response to cloud-based threats.

Capabilities

Query Tools

Tool	What It Does
CloudTrail search	Search API activity by username, access key, IP, event type
IAM role analysis	Scan all roles for over-privileged access
Single role analysis	Deep security analysis of a specific role
Auth model discovery	Identify how users authenticate (Identity Center, SAML, IAM, etc.)
Identity mapping	Map user email to AWS role sessions
CrowdStrike correlation	Find AWS sessions related to endpoint alerts

Action Tools

Action	Description
Terminate EC2 instances	Stop and remove compromised instances
Disable IAM user	Deactivate all access keys for a user
Delete IAM user	Remove user, keys, policies, group memberships, MFA
Delete access key	Remove a specific compromised access key
Detach admin policies	Remove AdministratorAccess, PowerUserAccess, IAMFullAccess
Block IP in WAF	Add IP to WAF IP set to block traffic

All actions require explicit approval before execution.

Setup

Connection Method

Hiro connects via IAM AssumeRole with temporary credentials. You create an IAM role in your AWS account that Hiro can assume.

Create an IAM role

Create a new IAM role in your AWS account:

Go to IAM > Roles > Create role
Select Custom trust policy
Use this trust policy (replace YOUR_EXTERNAL_ID with a unique identifier):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::605862532274:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

The External ID can be any unique string (e.g., your organization ID, a UUID, or a random string). It prevents confused deputy attacks by ensuring only authorized parties can assume the role.

Attach permissions

Attach the AWS managed policy for your desired access level:For investigations (recommended):

arn:aws:iam::aws:policy/ReadOnlyAccess - Full read access across all AWS services

Alternative options:

arn:aws:iam::aws:policy/SecurityAudit - Security-focused read access
arn:aws:iam::aws:policy/job-function/ViewOnlyAccess - Limited read access (not recommended - missing IAM visibility)

For remediation actions (optional):Create a custom policy with:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IAMRemediation",
      "Effect": "Allow",
      "Action": [
        "iam:UpdateAccessKey",
        "iam:DeleteAccessKey",
        "iam:DeleteUser",
        "iam:DetachUserPolicy",
        "iam:RemoveUserFromGroup",
        "iam:DeleteLoginProfile"
      ],
      "Resource": "*"
    },
    {
      "Sid": "EC2Remediation",
      "Effect": "Allow",
      "Action": [
        "ec2:TerminateInstances"
      ],
      "Resource": "*"
    },
    {
      "Sid": "WAFRemediation",
      "Effect": "Allow",
      "Action": [
        "wafv2:UpdateIPSet"
      ],
      "Resource": "*"
    }
  ]
}

Connect in Hiro

In Hiro, go to Settings > Integrations > AWS:

Enter the Role ARN (e.g., arn:aws:iam::123456789012:role/HiroSecurityRole)
Enter the External ID (must match what you configured in the trust policy)
Click Connect

Investigation Examples

Search CloudTrail

Show me all API calls by john@company.com in the last 24 hours

Hiro searches CloudTrail and returns:

API actions performed
Source IP addresses
Success/failure status
Request parameters

Investigate an access key

What has access key AKIA... done in the last week?

Analyze IAM permissions

What permissions does the AdminRole have? Is it over-privileged?

Hiro analyzes the role and reports:

Attached policies
Effective permissions
Security issues and risk score
Recommendations

Discover auth patterns

How do users authenticate to AWS in this account?

Hiro analyzes CloudTrail to identify:

Identity Center
SAML federation
OIDC federation
IAM users
Access keys

Remediation Actions

Example action proposal:

PROPOSED ACTION: Delete AWS Access Key
──────────────────────────────────────
Access Key: AKIA...XYZ
Owner: john@company.com
Reason: Key used from suspicious IP after Okta compromise
Evidence:
  • Key used from 185.220.101.1 (Tor exit node)
  • 47 API calls in 5 minutes (unusual volume)
  • Attempted AssumeRole to AdminRole
Confidence: High (94%)

[Approve]  [Reject]

Multi-Account Support

To monitor multiple AWS accounts:

Create the IAM role in each account
Add each Role ARN in Hiro’s AWS integration settings
Hiro will aggregate activity across all accounts during investigations

What’s Not Supported

S3-specific tools
RDS, Lambda, DynamoDB tools
CloudFormation management

Troubleshooting

”Access Denied” on AssumeRole

If you see errors like User is not authorized to perform: sts:AssumeRole:

Verify the trust policy - Ensure Hiro’s account (605862532274) is in the Principal
Check the External ID - The External ID in Hiro must exactly match your trust policy condition
Confirm the Role ARN - Double-check for typos in the role name or account ID

”Access Denied” on specific actions

If AssumeRole succeeds but queries fail (e.g., iam:GetRole denied):

Your role is missing permissions. Attach ReadOnlyAccess for full read access
ViewOnlyAccess is not sufficient - it lacks IAM visibility

Missing events

CloudTrail events can take up to 15 minutes to appear. Recent activity may not show immediately.

Multi-account issues

When monitoring multiple accounts, ensure the IAM role exists in each account with the same trust policy pointing to Hiro’s account.

Overview

Identity

Cloud & Infrastructure

Endpoint & Code

Communication

Capabilities

Query Tools

Action Tools

Setup

Connection Method

Investigation Examples

Search CloudTrail

Investigate an access key

Analyze IAM permissions

Discover auth patterns

Remediation Actions

Multi-Account Support

What’s Not Supported

Troubleshooting

”Access Denied” on AssumeRole

”Access Denied” on specific actions

Missing events

Multi-account issues

Next Steps

Okta

CrowdStrike

​Capabilities

​Query Tools

​Action Tools

​Setup

​Connection Method

​Investigation Examples

​Search CloudTrail

​Investigate an access key

​Analyze IAM permissions

​Discover auth patterns

​Remediation Actions

​Multi-Account Support

​What’s Not Supported

​Troubleshooting

​”Access Denied” on AssumeRole

​”Access Denied” on specific actions

​Missing events

​Multi-account issues

​Next Steps

Okta

CrowdStrike

Capabilities

Query Tools

Action Tools

Setup

Connection Method

Investigation Examples

Search CloudTrail

Investigate an access key

Analyze IAM permissions

Discover auth patterns

Remediation Actions

Multi-Account Support

What’s Not Supported

Troubleshooting

”Access Denied” on AssumeRole

”Access Denied” on specific actions

Missing events

Multi-account issues

Next Steps