Can I use Dome9 to block the access to the cloud accounts?

[Martins]

Hi,
Can I use Dome9 to block the access to the cloud accounts?

The ideia is just alow the access from the specifics ips.

Thank you.

[Marina_Segal]

Hello,
You can use Dome9 Full Protection mode to achieve it. AWS Security Group can be managed directly from Dome9 and attempts to modify a security group from the AWS/Azure environment will be detected by Dome9 and will trigger Tamper Protection and can also send an alert/notification. Dome9 will override the change that was made, and revert it back to the definition of the Security Group defined in Dome9.
https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/Network-Security/FullProtectionM...

[Martins]

Hi Marina,

Let me be more specific.

Can I block the access to AWS console with Dome9 and alow just to specifics IPs?

Thank you very much. 

[dome9tom]

Hi Martins,

If you use the AWS-native, IAM policy-based access control mechanism described here:
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html

...then you can use the Dome9 Compliance Engine to continuously assure that that cloud-native access control is properly configured, using a GSL Rule with the following form:

IamUser should have combinedPolicies contain [ policyDocument.Statement contain [ Effect='Deny' and Action='*' and Resource='*' and Condition.ForAllValues:NotIpAddress.aws:SourceIp contain-all [ $ in('aaa.bbb.ccc.ddd/32','eee.fff.ggg.hhh/32','iii.jjj.kkk.lll/32','mmm.nnn.ooo.ppp/32') ] ] ]

[Eyal_Fingold]

You can actually use this policy with IAM-Safety module in dome9.

https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Documentation/IAM-Safety/IAMSafety.html

So, if you use the deny policy within the restricted policy and apply to users, enable the permission but it will verify that all users are in a group enforcing to use form the IPs you choose to enable.