Connecting AWS IAM (Single Account)

Lumos connects to an individual AWS account by assuming a cross-account IAM role.

Prerequisites

• Elevated AWS IAM permissions

Connection Instructions

Step 1: Create IAM Role for Lumos

Option A: AWS Console

1. IAM Console → Roles → Create Role

2. Select Another AWS account → Account ID: 349123981986

   • Enable Require external ID → enter secure value

3. Attach the following policies:

   • SecurityAudit

   • AWSCloudTrailReadOnlyAccess

   • A custom policy with the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowAccessToIdentityCenter",
        "Effect": "Allow",
        "Action": [
          "iam:ListUsers",
          "iam:GetUser",
          "iam:ListRoles",
          "iam:GetRole",
          "iam:ListGroups",
          "iam:ListGroupsForUser",
          "iam:SimulatePrincipalPolicy",
          "iam:ListPolicies",
          "iam:ListAttachedUserPolicies",
          "iam:ListAttachedRolePolicies",
          "iam:ListAttachedGroupPolicies",
          "iam:AttachUserPolicy",
          "iam:DetachUserPolicy",
          "iam:AddUserToGroup",
          "iam:RemoveUserFromGroup",
          "iam:PutUserPolicy",
          "iam:DeleteUserPolicy",
          "iam:CreateUser",
          "iam:CreateLoginProfile",
          "iam:DeleteUser",
          "iam:GetUserPolicy",
          "iam:GetLoginProfile",
          "iam:DeleteLoginProfile",
          "iam:ListAccessKeys",
          "iam:DeleteAccessKey",
          "iam:ListSigningCertificates",
          "iam:DeleteSigningCertificate",
          "iam:ListSSHPublicKeys",
          "iam:DeleteSSHPublicKey",
          "iam:ListServiceSpecificCredentials",
          "iam:DeleteServiceSpecificCredential",
          "iam:ListMFADevices",
          "iam:DeactivateMFADevice",
          "iam:ListVirtualMFADevices",
          "iam:DeleteVirtualMFADevice",
          "iam:ListUserPolicies",
          "sts:GetCallerIdentity",
          "cloudtrail:LookupEvents"
        ],
        "Resource": "*"
      },
      {
        "Sid": "AccessToSSOProvisionedRoles",
        "Effect": "Allow",
        "Action": [
          "iam:AttachRolePolicy",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:GetRole",
          "iam:CreateRole",
          "iam:DeleteRole",
          "iam:PutRolePolicy",
          "iam:UpdateRole",
          "iam:ListRolePolicies",
          "iam:UpdateRoleDescription"
        ],
        "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
      },
      {
        "Sid": "AccessToSCIMProvider",
        "Effect": "Allow",
        "Action": [
          "iam:GetSAMLProvider"
        ],
        "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
      }
    ]
  }

4. Edit the trust relationship:

   • Set Principal to: arn:aws:iam::349123981986:user/global-service-account

   • on the "Name, review, and create" page, click edit next to Step 1. Change the value of the AWS key (within Principal) to the following: "arn:aws:iam::349123981986:user/global-service-account"

     1. Click 'Create role'

5. The connector will use the default 1 hour session duration

6. Copy the role ARN and external ID → paste into Lumos → click Connect.

Option B: Terraform

data "aws_iam_policy" "SecurityAudit" {
  arn = "arn:aws:iam::aws:policy/SecurityAudit"
}

data "aws_iam_policy" "CloudTrailReadOnly" {
  arn = "arn:aws:iam::aws:policy/AWSCloudTrailReadOnlyAccess"
}

resource "aws_iam_policy" "DeprovisionIAMUser" {
  name = "DeprovisionIAMUser"
  policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AllowAccessToIdentityCenter",
        "Effect": "Allow",
        "Action": [
          "iam:ListUsers",
          "iam:GetUser",
          "iam:ListRoles",
          "iam:GetRole",
          "iam:ListGroups",
          "iam:ListGroupsForUser",
          "iam:SimulatePrincipalPolicy",
          "iam:ListPolicies",
          "iam:ListAttachedUserPolicies",
          "iam:ListAttachedRolePolicies",
          "iam:ListAttachedGroupPolicies",
          "iam:AttachUserPolicy",
          "iam:DetachUserPolicy",
          "iam:AddUserToGroup",
          "iam:RemoveUserFromGroup",
          "iam:PutUserPolicy",
          "iam:DeleteUserPolicy",
          "iam:CreateUser",
          "iam:CreateLoginProfile",
          "iam:DeleteUser",
          "iam:GetUserPolicy",
          "iam:GetLoginProfile",
          "iam:DeleteLoginProfile",
          "iam:ListAccessKeys",
          "iam:DeleteAccessKey",
          "iam:ListSigningCertificates",
          "iam:DeleteSigningCertificate",
          "iam:ListSSHPublicKeys",
          "iam:DeleteSSHPublicKey",
          "iam:ListServiceSpecificCredentials",
          "iam:DeleteServiceSpecificCredential",
          "iam:ListMFADevices",
          "iam:DeactivateMFADevice",
          "iam:ListVirtualMFADevices",
          "iam:DeleteVirtualMFADevice",
          "iam:ListUserPolicies",
          "sts:GetCallerIdentity",
          "cloudtrail:LookupEvents"
        ],
        "Resource": "*"
      },
      {
        "Sid": "AccessToSSOProvisionedRoles",
        "Effect": "Allow",
        "Action": [
          "iam:AttachRolePolicy",
          "iam:DeleteRolePolicy",
          "iam:DetachRolePolicy",
          "iam:ListAttachedRolePolicies",
          "iam:GetRole",
          "iam:CreateRole",
          "iam:DeleteRole",
          "iam:PutRolePolicy",
          "iam:UpdateRole",
          "iam:ListRolePolicies",
          "iam:UpdateRoleDescription"
        ],
        "Resource": "arn:aws:iam::*:role/aws-reserved/sso.amazonaws.com/*"
      },
      {
        "Sid": "AccessToSCIMProvider",
        "Effect": "Allow",
        "Action": [
          "iam:GetSAMLProvider"
        ],
        "Resource": "arn:aws:iam::*:saml-provider/AWSSSO_*_DO_NOT_DELETE"
      }
    ]
  })
}

resource "aws_iam_role" "lumos_iam_role" {
  name = "LumosSingleAccountIntegrationRole"
  max_session_duration = 43200

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = {
        AWS = "arn:aws:iam::349123981986:user/global-service-account"
      },
      Condition = {
        StringEquals = {
          "sts:ExternalId" = "CHOOSE_YOUR_EXTERNAL_ID"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "attach_security_audit" {
  role       = aws_iam_role.lumos_iam_role.name
  policy_arn = data.aws_iam_policy.SecurityAudit.arn
}

resource "aws_iam_role_policy_attachment" "attach_cloudtrail" {
  role       = aws_iam_role.lumos_iam_role.name
  policy_arn = data.aws_iam_policy.CloudTrailReadOnly.arn
}

resource "aws_iam_role_policy_attachment" "attach_deprovision" {
  role       = aws_iam_role.lumos_iam_role.name
  policy_arn = aws_iam_policy.DeprovisionIAMUser.arn
}

Capabilities

Activity Tracking

Last Login Activity (get_last_activity):
- Uses PasswordLastUsed field from IAM User data
- Tracks LAST_LOGIN event type
- Returns timestamp of most recent password-based login only
- Available for all users with password-enabled accounts
- Does NOT track CloudTrail events in this capability

What gets tracked:
- get_last_activity: Password last used timestamp only

Troubleshooting

"Access Denied" when assuming role

Possible causes:
- Service Role ARN is incorrect
- External ID doesn't match trust policy
- Lumos AWS account not trusted in role
- Role doesn't exist or was deleted

Solutions:
- Verify Service Role ARN is correct
- Check External ID matches exactly (case-sensitive)
- Confirm trust policy includes Lumos account: 349123981986
- Verify role exists in IAM console

"Insufficient permissions" errors

What this means:
The assumed role doesn't have required IAM permissions.

Solution:
- Verify IAMFullAccess policy is attached (or custom policy with all required actions)
- Check CloudTrailReadOnlyAccess is attached for activity tracking
- Review CloudWatch Logs for specific permission errors
- Add missing permissions to role policy

Cannot delete user - "DeleteConflict" error

What this means:
User has attached resources (access keys, MFA devices, etc.) that must be removed first.

Solution:
- Integration automatically handles cleanup
- If error persists, manually check for:
- Attached managed policies
- Inline policies
- Access keys
- MFA devices
- SSH keys
- Service-specific credentials

Activity tracking not working

Possible causes:
- CloudTrail not enabled in account
- CloudTrail logs not accessible
- Service role missing CloudTrail permissions

Solution:
- Enable CloudTrail in AWS account
- Verify CloudTrail is logging AssumeRole events
- Ensure service role has CloudTrailReadOnlyAccess policy
- Check CloudTrail event history in AWS console

Summary

The AWS IAM integration provides comprehensive IAM management:

✅ Syncs all IAM users, roles, groups, and policies
✅ Full user provisioning (create/delete)
✅ Manages group memberships
✅ Assigns roles via inline policies
✅ Attaches/detaches policies
✅ Tracks password last used and role assumptions
✅ Secure cross-account access with External ID
✅ Comprehensive user deletion with automatic cleanup

Important notes:
- Requires IAM service role with External ID
- Uses the default 1 hour session duration
- Activity tracking via PasswordLastUsed and CloudTrail
- Role assignments via inline AssumeRole policies
- User deletion includes automatic resource cleanup
- Deactivation uses DenyAllAccess inline policy

The integration provides reliable IAM lifecycle management with comprehensive permission and activity tracking.