Frequently asked questions

#What is Cloud Certainty Watchtower?

Watchtower is a better console for AWS Security Hub, and it runs entirely in your own AWS account. It indexes the findings of every account and Region of your organisation for instant search with filters and counts, groups them into a fix list ranked by risk with Terraform, CloudFormation and AWS CLI remediation, tracks the work as tasks with SLA due dates, records accepted risks as exceptions that expire, and maps findings to the Terraform and CloudFormation on GitHub that created the resources, with fix pull requests and code scanner results alongside. Administrators grant users and groups access per account and Region, and every Security Hub call names the person in CloudTrail. You install it with one CloudFormation stack, and no data leaves your account.

#Pricing

#How much does it cost?

Watchtower is sold on AWS Marketplace with contract pricing: pay monthly, or for 12 months up front.

Prices are in US dollars and billed through your AWS bill. Plans are not priced per user or per finding: everyone in your organisation can use Watchtower.

#Why do Business and Enterprise appear as add-ons?

On the Watchtower listing, Team is the base plan and Business and Enterprise are add-ons to it. For Business, choose Team and the Business add-on; for Enterprise, choose all three. A plan counts only when every plan below it is in the contract too, so an add-on bought on its own grants nothing. Starter is a separate listing, Watchtower Starter.

#What else do I pay for?

The AWS resources the stack uses in your account are billed to you by AWS as usual. Watchtower is serverless, so it costs little beyond the sync that keeps its index fresh.

#Does Watchtower add to my Security Hub bill?

No. AWS Security Hub CSPM bills security checks and finding ingestion events, as it does today. Watchtower runs no checks and imports no findings: it reads findings, and, when you allow it, changes their workflow status, notes and severity.

#What happens when the contract ends?

Watchtower keeps working on the last plan for up to 72 hours, then every page says a licence is required and only the licence page works for administrators. All data (tasks, exceptions, saved views, settings, the audit log) stays in your account, and subscribing again unlocks it. The same 72 hours cover a brief outage of AWS License Manager. Nothing changes in Security Hub.

#Plans

#What does each plan include?

• Every plan has the findings explorer with search, the query language, filters with counts, grouping and private saved views; the fix list with remediation guides (Terraform, CloudFormation, AWS CLI); finding detail with live history; triage written back to Security Hub (workflow, notes, severity); tasks with SLAs and progress; the Overview with trends, mean time to remediate and ageing; Compliance; grants per account and Region; connections to other accounts; the audit log; and IAM Identity Center and Cognito sign-in with MFA.
• Team adds shared saved views, exceptions with expiry, GitHub and GitHub Enterprise Server code mapping, GitHub issues from tasks, and SAML and OIDC identity providers.
• Business adds fix pull requests, the built-in Trivy scanner, SonarCloud and SonarQube, SARIF uploads from CI, and the IP allowlist.
• Enterprise has every feature with the highest limits.

#How are AWS accounts counted?

Monitored accounts are the distinct AWS accounts your findings belong to, across all connections, the hub account included. With a Security Hub delegated administrator, one connection brings in every member account, and each counts. Above the limit, Watchtower indexes the accounts with the lowest account ids and lists the others as skipped under Administration › Sync; they keep working in Security Hub as before.

Connections are the IAM roles Watchtower uses, the hub's own local connection included. Most organisations need one or two: the delegated administrator, and the hub account.

#Deployment

#Which AWS Regions are supported?

Any Region with AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amazon S3, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate, for example us-east-1, eu-west-1, eu-west-2, eu-central-1 and ap-southeast-2. The same template URL works in every Region. The Region you deploy to doesn't limit which Security Hub Regions you can read.

#How do I install it?

Subscribe on AWS Marketplace and launch one CloudFormation stack in the account that subscribed. Creation takes about 10 minutes. Then connect your Security Hub delegated administrator with a small role stack, or deploy the hub in that account. See Getting started and the installation guide.

#Where should the hub run?

Either in any account of your organisation (for example a security tooling account), with the spoke role template deployed in the Security Hub delegated administrator account, or in the delegated administrator account itself with LocalRegions set to the aggregation Region. See Choose where the hub runs.

#How do I set up a Security Hub delegated administrator?

Watchtower reads one account and Region that holds every finding: the delegated administrator's aggregation Region. If you don't have one yet:

1. From your AWS Organizations management account, in your home Region, designate a delegated administrator for Security Hub, normally a security tooling account:
   bash

   aws securityhub enable-organization-admin-account --admin-account-id 111122223333 --region eu-west-1

2. In the delegated administrator account, turn on cross-Region aggregation in that Region, linking every other Region:
   bash

   aws securityhub create-finding-aggregator --region-linking-mode ALL_REGIONS --region eu-west-1

3. In the Security Hub console of the delegated administrator, use central configuration to enable Security Hub CSPM, your standards and controls in every account and Region of the organisation.

The AWS Security Hub User Guide covers these steps in detail. Then connect that account and Region to Watchtower (installation guide).

#Does anything run in my VPC?

Only one-off AWS Fargate tasks: the installer, for about a minute at install and at each upgrade, and the Trivy scanner, for a few minutes per scan if you use it. They need outbound HTTPS. Nothing accepts inbound connections, and the rest of the stack is serverless.

#Which identity providers work?

Amazon Cognito users (with required MFA) and AWS IAM Identity Center on every plan. Other SAML 2.0 providers, such as Microsoft Entra ID and Okta, and OIDC providers on Team and above. See Identity providers.

#Data and security

#Does Watchtower change my infrastructure?

No. Watchtower's roles can't change AWS resources. The only thing it can change in AWS is, with a Triage connection and a person's triage permission, the workflow status, note and severity of Security Hub findings. Fixes change code: Watchtower opens a pull request on a new branch, and a person on your team reviews and merges it, and your pipeline deploys it. Watchtower never merges or deploys anything.

#Does any data leave my account?

Your findings, tasks, exceptions, settings and the audit log stay in your account, in DynamoDB and a private S3 bucket. Cloud Certainty runs no service in the data path, and Watchtower sends no telemetry. The licence check is a read from AWS License Manager in your own account.

Watchtower contacts outside services only when you configure them: your GitHub or GitHub Enterprise Server (reading code; and, when someone opens a fix pull request or a GitHub issue, writing finding titles, account ids and resource ids into it), your SonarCloud or SonarQube, and the optional daily read of a public release manifest, which sends nothing about you (set UpdateChecks to Disabled to turn it off). See the security overview.

#Can users only see what they are granted?

Yes. Users see no findings until an administrator grants them access, by AWS account pattern and Region. Security Hub itself has no permissions per member account, so Watchtower filters every search, count, export and detail to the caller's grants, and checks every finding in a change. AWS session policies then limit what each session may do: someone without triage gets a session that can't change findings. See Account grants and Security Hub.

#Who changed which finding?

Watchtower's audit log records every change, and CloudTrail records each Security Hub call with the user's email as its sourceIdentity. Notes written to Security Hub carry the author's email, and the finding's history shows every change.

#How does it compare?

#Why not the Security Hub console?

Watchtower doesn't replace the Security Hub console for configuring Security Hub (standards, controls, automation rules, integrations). It replaces it for working through the findings:

#We already run Trivy, Checkov or SonarCloud. Why Watchtower?

Shift-left scanners and Security Hub see the same problems from two ends: a scanner flags aws_s3_bucket.logs before deployment, Security Hub flags the bucket after it. Usually two teams see two reports. Watchtower keeps your scanners and puts their results next to the cloud findings: rules are mapped to Security Hub controls, so a cloud finding shows "also flagged by Trivy in infra/s3.tf:12", and the fix list shows what CI already knows. It adds what scanners don't have: the findings of what is actually deployed (including resources created outside code, and Amazon GuardDuty, Amazon Inspector and Amazon Macie findings), triage, SLAs and pull requests that fix the code. Run them in CI and upload their SARIF, or let Watchtower run Trivy for you.

#Is Watchtower a ticketing system?

It has tasks, made for remediation: progress comes from the findings, and tasks close themselves when the findings close. On Team and above a task can also create a GitHub issue. Jira and other ticketing integrations are on the roadmap.

#Security Hub

#Which findings does Watchtower read?

Every finding in AWS Security Hub CSPM, in the AWS Security Finding Format (ASFF): Security Hub controls, Amazon GuardDuty, Amazon Inspector, Amazon Macie, IAM Access Analyzer, AWS Config, AWS Firewall Manager and partner products. Active findings are kept, and closed ones for 30 days by default. Passed control checks are counted for Compliance rather than stored one by one.

#What about the new AWS Security Hub with OCSF findings?

AWS now has two services: AWS Security Hub CSPM (the Security Hub you have used so far, with ASFF findings and the GetFindings API) and the new AWS Security Hub, which correlates findings in the Open Cybersecurity Schema Framework (OCSF) with exposure and attack path context. Watchtower 0.1 reads Security Hub CSPM. Reading the new Security Hub's OCSF findings alongside is on the roadmap for the next release.

#Does Watchtower need Security Hub in every account?

Security Hub CSPM must be enabled in the accounts and Regions whose findings you want, as usual. Watchtower itself only needs access to the account and Region where they are gathered: the delegated administrator's aggregation Region.

#Limits

#Upgrades

#How do I install a new release?

Each release is a new template. Update the stack with the new template URL and keep your parameter values. Administrators see a banner when a new release is out. See the upgrading guide and the release notes.

#How do I change plan?

Email [email protected]: we prepare an AWS Marketplace offer that credits the rest of your current contract. Between Team, Business and Enterprise no stack update is needed: the new limits and features apply when the new contract is active, and Watchtower keeps working on your current plan for up to 72 hours while the agreement changes. Your tasks, exceptions, views and settings stay as they are. See Changing plan.

#Support

#How do I get help?

Basic support is included: email [email protected] with your stack's Region, the release you run (the ProductVersion stack output) and what you see. We respond within one business day. Paid support plans with response times are on the support page.

#Does Cloud Certainty have access to my account?

No. We have no access to your account and Watchtower doesn't give us any. When you ask for help, you share what you choose, such as an error message or a finding id.