Cisco Multicloud Defense User Guide

PDF

Cisco Multicloud Defense User Guide

Connect AWS account to Multicloud Defense Controller from the Multicloud Defense dashboard

Updated: July 8, 2026

Want to summarize with AI?

Log in

Connect AWS accounts to Cisco Multi-Cloud Defense using an automated CloudFormation template and ensure cloud resource security.

Multicloud Defense has created a CloudFormation template that makes it easy to connect an AWS account to the Multicloud Defense Controller.

Before you begin

Read these requirements before you connect an AWS account to Multicloud Defense:

  • Ensure you have requested a Multicloud Defense Controller for your Security Cloud Control tenant.

  • The name of the cloud storage bucket in your AWS account must be between 3 and 65 characters. Bucket names exceeding 65 characters will cause an error during the connection process.

Note

Multicloud Defense Controller version 23.10 defaults to IMDSv2 in the AWS EC2 instance when using Multicloud Defense Gateway version 23.04 or newer. For more information about the difference between IMDSv1 and IMDSv2, see AWS documentation.

Procedure

  1. In the left pane, click Multicloud Defense.

  2. Click Multicloud Defense Controller.

  3. In the Cloud Accounts pane, click Add Account.

  4. On the General Information page, choose AWS from the Account Type list box.

  5. Click Launch Stack to download and deploy our CloudFormation template. This should open up another tab to deploy the template. Logging in to AWS is required.

  6. Acknowledge that the AWS CloudFormation might create IAM resources with custom names.

  7. Enter these information:

    • AWS Account Number: Enter the AWS account number of the account you want to secure. This number can be found in the output value CurrentAccount of the CloudFormation Template.

    • Account Name: Enter the name you want to give your account once it has been onboarded.

    • Description:(Optional) Enter an account description.

    • External ID: A random string for trust policy of the IAM role. This value will be used in the controller IAM role created. You can edit or regenerate the External ID.

    • Controller IAM Role: This is the IAM role created for theMulticloud Defense Controller during CloudFormation Template (CFT) deployment. Look for the output value MCDControllerRoleArn in CFT stack. It should be something similar to this: arn:aws:iam::<Acc Number>:role/ciscomcdcontrollerrole.

    • Inventory Monitor Role: This is the IAM role created for Multicloud Defense Inventory during CFT deployment. Look for the output value MCDInventoryRoleArn in CFT stack. Should be something similar to this: arn:aws:iam::<Acc Number>:role/ciscomcdinventoryrole.

  8. Click Save and Continue.

    You return to the Multicloud Defense dashboard, where you will see that you have a new AWS cloud account recorded.

Your AWS account is connected, and resources are secured within Cisco Multi-Cloud Defense.

What to do next

  1. Add the correct permissions to your AWS account to ensure secure access and communication.

  2. Enable traffic visibility.