Technical Tip: Required IAM Permissions for Security Hub and Kinesis for AWS integration

[calvinc97]

Description	This article describes the equired IAM Permissions for Security Hub and Kinesis for AWS integration.
Scope	FortiSIEM.
Solution	FortiSIEM integrates with several AWS services (such as CloudTrail, Security Hub, and Kinesis) to collect and process security events. To ensure secure integration, it is recommended to assign least privilege IAM permissions. Minimum IAM Permissions: Amazon SQS (CloudTrail Integration): FortiSIEM requires access to read CloudTrail notifications from SQS queues: sqs:ReceiveMessage sqs:DeleteMessage sqs:GetQueueAttributes sqs:ChangeMessageVisibility (optional, for handling long polls) AWS Security Hub. FortiSIEM ingests findings from Security Hub and may need to enable the following services: securityhub:* AWS Kinesis Data Streams. FortiSIEM ingests findings from Security Hub and may need to enable the following services: kinesis:DescribeStreamSummary kinesis:GetShardIterator kinesis:GetRecords kinesis:ListStreams Related documents: AWS Kinesis with FortiSIEM - FortiSIEM documentation  Controlling access to Amazon Kinesis Data Streams resources using IAM - AWS documentation  AWS Security Hub Permissions - AWS documentation