Automated AWS Asset Detection Feature Guide

Note:

The Automated AWS Asset Detection feature is available for customers with solution packaging only.

Introduction

The Data Mapping Discovery Automation feature from OneTrust allows you to sync with external systems with secure credentials to seamlessly generate records in your data map without extensive, technical setup. This promotes easier monitoring of assets to maintain up-to-date inventories, which improves visibility and reduces manual configuration fatigue.

This article covers how to set up an automation for AWS assets with essential information on the resource structure, naming convention, and credential configuration.

For additional information on how to manage automation details post setup, see Data Mapping Discovery Automation Overview. For guidance on reviewing pending assets, Inventory Review & Automation Feature Guide.

Discoverable Resources

OneTrust creates the AWS asset differently depending on the resource type:

Amazon Athena: Create one asset per instance found

Note:
OneTrust currently only supports Athena databases of Glue Data Catalog type.
Amazon DynamoDB: Create one asset per region that contains at least one table
Amazon RDS: Create one asset per instance found
Amazon Redshift: Create one asset per cluster found
Amazon SageMaker: Create one asset if any model exists
Amazon S3: Create one asset if any bucket exists

AWS Resource Organization

Accounts: resource container for access, billing, security, and service operations in AWS.
- Regions: separate geographic areas that comprise AWS Global Infrastructure.
  - Resource: an entity to facilitate AWS services and features.

Required Permissions

If a permission for a specific system is not provided, assets will not be captured in OneTrust.


System	Permission
Amazon Athena	ListDataCatalogs ListDatabases
Amazon DynamoDB	ListTables DescribeTable (optional for Encryption, Backup) DescribeContinuousBackups (optional for Encryption, Backup)
Amazon RDS	DescribeDBInstances
Amazon Redshift	DescribeClusters
Amazon SageMaker	ListModels
Amazon S3	ListBuckets
AWS Glue	GetDatabases

To set up automation

On the Data Mapping Automation menu, select Inventory > Assets. The Assets screen appears.
Click the Manage automation button. The Automations screen appears.
Click the Set up automation button. The Set up automation modal appears.
Select Assets for the configuration, then click the Next button.
Select the AWS tile.
The modal will update with automatically generated details for this new automation.
- The automation name defaults to "aws_" with a random, system-generated alphanumeric ID. Example: aws_eDyEXvF.
- Scanned assets will observe the following naming convention: {resource-name}_{region}_{accountId}
  
  Example: amazon_dynamodb_ca-central-1_333935724398
- If not related to a region (SageMaker, S3): {resource-type}_{accountId}
  
  Example: s3_333935724397
  
  Note:
  OneTrust will only create one asset for S3 to indicate it is being used, as there could large volumes of buckets across all regions.
- For more information see AWS Identity and Access Management for ARN formats.
Note:
The automation details are set to default and you can modify them later in the automation page. These can be modified post-setup. The automation will run upon creation.
Select existing credentials from prior automations or create new credentials.

Creating new credentials requires that you provide the AWS Access Key and AWS Secret Key from your targeted AWS account.
When finished, click the Create automation button. The automation will be executed and you will be navigated back to the Automations list screen.

Tip:
If an error message is shown for automation failure, check your credentials.
Your automation is now running and ready to populate your data map. The next sync will occur one month from the creation date. For additional information on how to manage automation details post setup, see Data Mapping Discovery Automation Overview.