Getting started

This guide is for the administrator or platform team who sets up Cloud Certainty Watchtower. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, connect your AWS Security Hub delegated administrator, look at your first fix list, create a task and give your team access. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run Watchtower (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager. It can be any account of your organisation, including the Security Hub delegated administrator account itself (see Choose where the hub runs).
• AWS Security Hub CSPM enabled in your organisation, ideally with a delegated administrator account and cross-Region aggregation, so that one account and one Region (the aggregation Region) hold the findings of every member account and Region. The FAQ shows how to set this up if you haven't.
• A supported Region for the hub: any Region with AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amazon S3, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate. The hub's Region doesn't limit which Security Hub Regions Watchtower reads.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only one-off tasks run there: the installer, for about a minute at install and at each upgrade, and the built-in Trivy scanner when you use it.
• The email address of your first administrator.

#1. Subscribe on AWS Marketplace

Watchtower is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the Watchtower listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. Starter is a separate listing, Watchtower Starter. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run Watchtower, as an identity that may subscribe to AWS Marketplace products.
2. Open Watchtower on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-watchtower-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=watchtower

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-watchtower-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

#4. Connect the Security Hub delegated administrator

Watchtower reads findings through connections. The local connection, to the hub's own account, exists from the start. If the hub runs in your delegated administrator account and LocalRegions is the aggregation Region, you are already connected: skip to step 5.

Otherwise, connect the delegated administrator account:

1. In the delegated administrator account, deploy the spoke role template. Its URL is the hub's SpokeTemplateUrl output. Set HubApiRoleArn to the hub's ApiRoleArn output, HubSyncRoleArn to its SyncRoleArn output, choose an ExternalId of at least 16 characters and an AccessLevel (Read by default, or Triage).
2. In Watchtower, open Administration › Connections and add a connection: an id, a name, the account ID, the same access level, the spoke stack's RoleArn output, the same external ID, and the aggregation Region as the hub Region.
3. Test the connection. Watchtower assumes the role and reports, for each hub Region, whether Security Hub is enabled, the aggregation Region and its linked Regions, the enabled standards and a sample count of findings.

See Connect the delegated administrator for the StackSet and CLI variants.

#5. The first sync

A sync worker reads the findings of each connection and hub Region into Watchtower's own index, in the stack's private data bucket. It runs every 5 minutes and syncs each source when it is due:

• The first sync is a full sync and starts within 5 minutes of adding the connection (or of the stack finishing, for the local connection). It takes a few minutes for most organisations, longer for hundreds of thousands of findings. To start it at once, start a sync from Administration › Sync.
• A full sync then runs every 24 hours (a setting, 6 to 168 hours).
• Incremental syncs read only what changed, every 15 minutes by default (a setting; never faster than your plan allows: 60 minutes on Starter, 15 on Team, 5 on Business and Enterprise).

Administration › Sync shows each source's status, when it last synced, how many findings it holds and any error. The findings page says how old its data is.

#6. Look at the fix list

Open Fix list. Instead of thousands of rows, it shows issues: findings grouped by what fixes them (one Security Hub control, such as S3.8, across every account), ranked by risk, which grows with the severity, the number of open findings, their age and whether resources are exposed to the internet. Each issue shows how many resources and accounts it covers and how many findings are overdue.

Open the top issue. For about 60 common controls it has a remediation guide written for engineers: why it matters, console steps, the AWS CLI, and Terraform and CloudFormation snippets. Below it are the affected findings. The user guide explains every page.

#7. Create a task

From the issue, create a task for its open findings: give it a title, an assignee and labels. Its priority comes from the highest severity, and its due date from the SLA of that severity (7 days for critical findings, 30 for high ones by default). Watchtower tracks the progress from the findings themselves (for example "12 of 38 closed") and closes the task when the last finding is closed.

With a Triage connection and the triage permission, you can also mark the findings NOTIFIED in Security Hub with a note pointing at the task. See Tasks.

#8. Invite your team

1. Give people a way to sign in. With an identity provider, assign users or groups to the Watchtower application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no findings until a grant applies to them. In Administration › Grants, give a user or a group permissions (view, triage, fix) on AWS account patterns, on one connection or all, in some Regions or all. For example "the group platform-team may triage accounts 1111* in all Regions". See the admin guide.
3. Send them the PortalUrl and the user guide.

#Next steps

• Code integrations: map findings to Terraform and CloudFormation on GitHub, open fix pull requests, and add Trivy, SonarCloud and SARIF scanner results.
• Admin guide: roles, connections, grants, settings, usage, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.