Wiz sensor support on AWS

Set up Wiz sensors on Glean workloads that run on Amazon Elastic Compute Cloud (EC2) instances and Amazon Elastic Kubernetes Service (EKS) nodes. Glean installs and manages the sensors after you provide the required credentials, secret, and deployment details.

Setup instructions

Glean installs the Wiz sensors through the standard Glean deployment process. You do not need to install the sensors or change the Glean deployment yourself.

Requirements

Confirm that you have:

A Wiz account
Access to your Wiz tenant and permission to create a service account
Permission to create an AWS Secrets Manager secret in the same region as the Glean deployment
Permission to create a Key Management Service (KMS) customer managed key and configure cross-account access if the secret will be in a different AWS account
A way to provide the required deployment details to Glean Support

Configuration

Complete these steps before Glean deploys the sensors:

In Wiz, create a service account for a Wiz sensor. Follow the Wiz documentation for the required steps. Record the Client ID and Client Secret. Use the client secret later as WIZ_API_CLIENT_SECRET.
Collect the runtime sensor image pull key from your Wiz tenant. Go to Wiz tenant information to view the tenant details.

Record these values:
- Domain: Select registry.wiz.io from the drop-down when possible
- Username: Use this value later as WIZ_REGISTRY_USERNAME
- Password: Use this value later as WIZ_REGISTRY_PASSWORD
Create the AWS Secrets Manager secret described in Secret creation. Create it in the same region as the Glean deployment.
Provide the required details to Glean Support, as described in Share with Glean.
After you provide the details, Glean deploys the Wiz sensors.

Secret creation

Create an AWS Secrets Manager secret in the same region as the Glean deployment. Create the secret in the same AWS account as the Glean deployment, or in a different AWS account.

Secret in the same AWS account

If you create the secret in the same AWS account as the Glean deployment, Glean recommends encrypting it with the AWS managed aws/secretsmanager KMS key.

Create the secret, then continue to Secret contents.

Secret in a different AWS account

If you create the secret in a different AWS account than the Glean deployment, you must create a new customer managed key in Key Management Service (KMS).

Apply this JSON policy to the KMS key:

{
  "Version": "2012-10-17",
  "Id": "key-consolepolicy-3",
  "Statement": [
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::ACCOUNT-ID-THAT-THE-KMS-KEY-RESIDES-IN:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "Allow secrets manager use of the key",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::YOUR-GLEAN-DEPLOYMENT-AWS-ACCOUNT-ID:root"
      },
      "Action": [
        "kms:Decrypt",
        "kms:DescribeKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "secretsmanager.DEPLOYMENT-REGION.amazonaws.com"
        }
      }
    }
  ]
}

Attach this cross-account JSON policy to the secret:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowCrossAccountSecretRead",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::YOUR-GLEAN-DEPLOYMENT-AWS-ACCOUNT:root"
            },
            "Action": "secretsmanager:GetSecretValue",
            "Resource": "*"
        }
    ]
}

You cannot use the AWS managed aws/secretsmanager key for cross-account secrets.

Secret contents

The secret must contain a JSON string with this structure:

{
    "WIZ_API_CLIENT_SECRET": "ADD-ME",
    "WIZ_REGISTRY_USERNAME": "ADD-ME",
    "WIZ_REGISTRY_PASSWORD": "ADD-ME"
}

Include the following:

The Wiz Client Secret for WIZ_API_CLIENT_SECRET
The image pull registry username for WIZ_REGISTRY_USERNAME
The password for the image for WIZ_REGISTRY_PASSWORD

After you create the secret, record these Amazon Resource Name (ARN) values:

The ARN of the secret
The ARN of the KMS key that encrypted the secret. You can find this in the KMS console. For a secret encrypted with the aws/secretsmanager managed key, find the ARN under AWS managed keys in the AWS console.

After you complete the customer steps, provide Glean Support with these Wiz deployment details:

The Wiz Client ID
The ARN of the Secrets Manager secret
The ARN of the KMS key that encrypted the secret

Glean deploys the Wiz sensors with the values.

Pricing

Wiz reports to the customer's Wiz tenant. The customer is responsible for billing and capacity requirements. This typically requires a billable unit for each EC2 instance and EKS node instance. Contact Glean Support to discuss sizing.

Setup instructions​

Requirements​

Configuration​

Secret creation​

Secret in the same AWS account​

Secret in a different AWS account​

Secret contents​

Share with Glean​

Pricing​

See also​