How Citrix Leverages Cloudaware To Govern Its AWS and Azure Infrastructure

Citrix operates large scale AWS and Azure environments with over 100 AWS accounts and Azure Subscriptions. These accounts and subscriptions contain more than 1,000,000 configurable assets.

Citrix Cloud Security team relied on several open source frameworks to perform AWS compliance verification. Namely Cloud Custodian and Scout2. For Azure, Citrix created their in-house tools. As the cloud compliance program was maturing, certain challenges began to emerge.

• Each product division wanted to customize policies slightly to fit their risk profile
• Lack of exception handling process;
• Some tools caused API throttling issues for production application during scanning;
• Developer who was maintaining Azure compliance tool has left the company;
• Many compliance policies between AWS and Azure were duplicate especially those that related to tagging policy.

Cloudaware Modules Deployed

● Cloudaware CMDB

● Cloudaware Compliance Engine

● Cloudaware Incident Management

Solution

Cloudaware is a modular, SaaS based cloud management platform. Our CMDB uses collectors which in turn leverage AWS Config, AWS CloudTrail and service specific API calls to build complete inventory of all customer AWS infrastructure. Citrix used automatically generated CloudFormation StackSets and AWS Organizations where possible to create cross-account IAM role which allowed Cloudaware CMDB collectors to start harvesting information about current state of Citrix AWS infrastructure and populate CMDB.

In addition to supporting AWS, Cloudaware CMDB also supports Microsoft Azure and Google Compute cloud and provides integrations for VMWare. This allowed Citrix to create a single pane of glass for all of their infrastructure regardless of where it was hosted.

Tagging

Particular area importance for Citrix was enforcing consistent tagging standards across their infrastructure. Using our Tag Analyzer which is part of the CMDB, Citrix was able to better understand and correct deviations in their tagging coverage.

Compliance Engine

Cloudaware Compliance engine is a collection of over 300 cloud configuration policies and is a superset of policies available from frameworks such as Scout2, Cloud Custodian by CapitaOne, CloudConformity, Cloudcheckr, Cloudhealth and many others.

Cloudaware Compliance Engine has several key differentiators from other similar solution available on the market.

1. Extremely rich library of policies
2. Multi-cloud policies
3. Ability to author new and clone existing policies using Java programming language
4. Customize policies for specific accounts, VPCs, etc.
5. Ability to create policies that evaluate non-AWS attributes available in CMDB
6. Reduce number of API calls made to AWS by collecting once and running evaluations against CMDB, not against AWS inventory.
7. Integrate with 3rd party ticketing systems such as JIRA, ServiceNow, ServiceCloud, etc.
8. Automate exception handling processes.

Sample policy interface:

Exception Handling:

Incident Management

Cloudaware Incident Management allows customers to route policy violations to the appropriate teams.

This feature proved critical to Citrix because it has so many different engineering teams who use different ticketing systems. Cloudaware was able to route policy violations to the appropriate team and create tickets in in different JIRA instances, ServiceNow implementations, etc.

Incident Management module also provides sophisticated stateful integration with third party ticketing systems such as JIRA, ServiceNow, etc. and can not only open tickets but also close them and update them depending on the lifecycle of the violation. Citrix integrated Cloudaware Incident Management with its own in-house ticketing system using our outbound incident API. This allowed all the compliance engine policy violations to flow into Citrix’s systems of action.

Results

• Cloudaware now automatically validates against over 300 compliance policies derived from AWS, Azure, industry and internal best practices.
• Each product division maintains shares base set compliance and governance policies while having the option of creating their own department specific policies.
• Each product division can have custom exception handling and routing logic.
• Reduced administrative overhead by allowing users consistent and low friction process to request exemptions e.g. some S3 buckets are meant to be public after all.
• Eliminated issues with AWS API throttling during compliance checks because checks are ran against CMDB that in turn leverages CloudTrail and AWS Config to minimize “Describe*” API calls.
• One policy can now be applied to resources both in AWS and Azure
• Removed the need to maintain in-house Azure compliance tool.

Find out more about Cloudaware here.