Amazon Control Tower Aggregator

Amazon Web Services

Overview

The Amazon Control Tower Aggregator connector integrates with AWS Control Tower to synchronize EC2 instance inventory across every account and region governed by Control Tower. It connects to the Control Tower Audit Account in the configured home region and queries a named AWS Config aggregator (the aggregatorName property) that centralizes resource configuration data from all enrolled accounts. Using the AWS Config SelectAggregateResourceConfig API it runs an SQL query for AWS::EC2::Instance resources, pages through the results, and maps each instance to the Brinqa Host UDM model. The connector currently supports EC2 instances only.

Data retrieved from Amazon Control Tower Aggregator

Connector Object	Required	Maps to Data Model
EC2 Instance	Yes	Host

Model relationships

note

For detailed steps on how to view the data retrieved from Amazon Control Tower Aggregator in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Amazon Control Tower Aggregator from the Connector dropdown and provide the following:

Setting	Required	Default	Description
Aggregator name	Yes	—	Name of the aggregator to retrieve data from
Access key ID	Yes	—	AWS user access key ID
Secret access key	Yes	—	AWS user secret access key
External ID	Yes	—	External ID to use when assuming the role
Home region	Yes	us-east-1	Home AWS region
Assume role	No	—	Amazon Resource Name for the role to assume
Session duration	No	—	Assume role session duration in seconds
Page size	No	100	Maximum number of results to retrieve per operation
Parallel requests	No	min(4, available processors)	Maximum number of parallel requests

Authentication

Authentication uses the AWS SDK for Java v2. Credentials are resolved through the following chain (in order):

1. STS AssumeRole — if assumeRoleARN is configured, the connector builds base credentials (below), then calls AWS STS AssumeRole (passing the configured externalID and durationSeconds, with a unique session name per sync) and uses the resulting temporary session credentials.
2. Static access keys — if accessKey / secretKey are configured, they are used directly via StaticCredentialsProvider.
3. Default credentials provider chain — if the access key or secret key is blank, the connector falls back to the AWS default credentials provider chain (environment variables, ~/.aws/credentials, container role, or EC2 instance metadata).

The STS client and the AWS Config client are both created in the configured home region.

Required AWS API permissions

Permission	Purpose
config:SelectAggregateResourceConfig	Query aggregated EC2 instance configuration across enrolled accounts and governed regions
sts:AssumeRole	Only when assumeRoleARN is set (assume the target role in the Audit/target account)

The connector calls only config:SelectAggregateResourceConfig; the aggregator is referenced by name from configuration, so it does not call config:ListConfigurationAggregators or config:DescribeConfigurationAggregators.

Sync Behavior

Each sync is a full sync. Every run enumerates all resources through the AWS APIs; the connector does not maintain a sync token or apply an incremental since date filter.

---

How to obtain Amazon Control Tower Aggregator credentials

Create an IAM user for Control Tower access

For the Amazon Control Tower Aggregator connector to query the Config Aggregator and retrieve EC2 instance data, you must provide specific AWS credentials and permissions. To create an IAM user, follow these steps:

1. Log in to the AWS Control Tower Audit Account Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option and then click Create policy.

6. Click the JSON tab and paste the following minimum required policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "config:SelectAggregateResourceConfig"
         ],
         "Resource": "*"
       }
     ]
   }

7. Click Next, provide a name for the policy, and then click Create policy.

8. Back on the Add permissions page, search for and select the policy you just created, and then click Next.

9. Click Create user.

Obtain access keys

After you have created an IAM user, generate the access keys that are required for the connector. To do so, follow these steps:

1. Navigate to the IAM dashboard.

2. From the navigation pane under Access management, click Users.

3. Choose the IAM user you created in the earlier steps.

4. Click the Security credentials tab and then click Create access key.

5. Select the Application running outside AWS use case and then click Next.

6. Provide a description and then click Create access key.

   The access key ID and secret access key display. The secret access key is shown only once and cannot be retrieved again, so copy the key and save it to a secure location.

Note: If you do not have the permissions to create access keys, contact your AWS administrator. For additional information, see AWS documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

EC2 Instance

Source Field Name	SDM Attribute
configuration.architecture	ARCHITECTURE
configuration.blockDeviceMappings[]	BLOCK_DEVICE_MAPPINGS (multivalued)
configuration.hypervisor	HYPERVISOR
configuration.iamInstanceProfile.arn	IAM_INSTANCE_PROFILE_ARN
configuration.imageId	IMAGE_ID
configuration.instanceType	INSTANCE_TYPE
configuration.kernelId	KERNEL_ID
configuration.keyName	KEY_NAME
configuration.launchTime	FIRST_SEEN
configuration.launchTime	LAUNCH_TIME
configuration.metadataOptions.httpTokens	IMDSV2_REQUIRED
configuration.monitoring.state	MONITORING
configuration.networkInterfaces[].ipv6Addresses	IPV6_ADDRESSES (multivalued)
configuration.networkInterfaces[].macAddress (normalized)	MAC_ADDRESSES (multivalued)
configuration.networkInterfaces[].ownerId	OWNER_IDS (multivalued)
configuration.placement.availabilityZone	AVAILABILITY_ZONE
configuration.platformDetails	OPERATING_SYSTEM
configuration.platformDetails + instanceType + architecture	DESCRIPTION
configuration.privateDnsName	PRIVATE_DNS_NAMES
configuration.privateDnsName (normalized)	HOSTNAMES
configuration.publicDnsName	PUBLIC_DNS_NAMES
configuration.ramDiskId	RAM_DISK_ID
configuration.rootDeviceName	ROOT_DEVICE_NAME
configuration.rootDeviceType	ROOT_DEVICE_TYPE
configuration.securityGroups[].groupId	SECURITY_GROUP_IDS (multivalued)
configuration.securityGroups[].groupName	SECURITY_GROUPS (multivalued)
configuration.state.name	PROVIDER_STATUS
configuration.state.name (normalized)	SOURCE_STATUS
configuration.stateTransitionReason	STATE_TRANSITION_REASON
configuration.subnetId	SUBNET_ID
configuration.tags	TAGS
configuration.tags[key="Name"].value	NAME
configuration.virtualizationType	VIRTUALIZATION_TYPE
configuration.vpcId	VPC_ID
EC2Instance.awsRegion	REGION
EC2Instance.resourceId	UID
EC2Instance.resourceId	INSTANCE_ID
networkInterfaces[].association.publicIp, configuration.publicIpAddress	PUBLIC_IP_ADDRESSES (multivalued)
networkInterfaces[].privateIpAddresses[].privateIpAddress, networkInterfaces[].privateIpAddress, configuration.privateIpAddress	PRIVATE_IP_ADDRESSES (multivalued)
NIC private IPs + NIC association.publicIp + configuration.privateIpAddress + configuration.publicIpAddress	IP_ADDRESSES (multivalued)
static	CATEGORIES
static	CLOUD_PROVIDER
sync runtime (Instant.now())	LAST_SEEN
sync runtime (Instant.now())	LAST_CAPTURED

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

EC2 Instance

Operation options

Option	Type	Default	Description
maxResults	Page size (limit) for each SelectAggregateResourceConfig call.	Shared pageSize configuration (100)

Delta sync

Not supported. The connector performs a full sync of EC2 Instance on every run and applies no incremental date filter.

API

• Type: AWS SDK for Java v2 (ConfigClient) · Endpoint: config:SelectAggregateResourceConfig

Changelog

Changelog

The Amazon Control Tower Aggregator connector has undergone the following changes:

Version	Description	Migration Steps
3.2.2	No changes in this release.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	New Features - STS AssumeRole authentication. The connector now supports AWS STS AssumeRole for cross-account and same-account IAM role assumption, in addition to static IAM credentials. When an Assume Role ARN is configured, the connector assumes the specified role using STS with a configurable session duration and external ID, enabling secure cross-account access to the Config Aggregator. - Configurable aggregator name. The Config Aggregator name is now a required configuration property (aggregatorName), replacing the previously hardcoded value of aws-controltower-GuardrailsComplianceAggregator. This allows the connector to work with custom aggregators in addition to the default Control Tower aggregator. - New configuration properties. Added aggregatorName, externalID, assumeRoleARN, and durationSeconds configuration properties for flexible authentication and aggregator targeting. Improvements - Centralized credential management. Refactored the AggregatorModel base class to encapsulate AWS credential resolution, STS client creation, and role assumption logic. The Instance model now delegates credential building to the base class instead of constructing static credentials inline, aligning with the pattern used by other AWS connectors. - Flexible credential provider chain. The Instance sync method now accepts AwsCredentialsProvider instead of raw AwsBasicCredentials, enabling support for both static credentials and STS-assumed role credentials through a unified provider interface. - Code quality improvements. Replaced lambda expressions with method references (IamInstanceProfile::arn, MetadataOptions::httpTokens, StringUtil::isNotBlank) for improved readability. Removed unnecessary variable initialization and updated test setup to cover all new configuration properties.	• New required property: aggregatorName must now be configured on each connector instance. Set this to the name of the Config Aggregator to query (e.g. aws-controltower-GuardrailsComplianceAggregator for the default Control Tower aggregator). Existing instances that relied on the previously hardcoded aggregator name must add this property before syncing.
3.1.0	Improvements - Sync failures are now visible. Previously, certain AWS API errors (throttling, server errors, transient network failures, validation errors) could be silently swallowed during multi-region sync, producing empty results without indicating a problem. These now surface as sync failures with a clear log entry detailing the HTTP status, AWS error code, request id, and service name. Per-region permission gaps (HTTP 401 / 403) still allow the sync to continue across other regions, but are now visible in logs.	N/A
3.0.20	Overview The Amazon Control Tower Aggregator connector integrates with Amazon Web Services to synchronize EC2 instance inventory aggregated across the accounts and regions managed under an AWS Control Tower landing zone. Category: Amazon Web Services Models	N/A