Modifica una conexión de AWS existente cuando cambie la configuración de tu entorno de AWS. Por ejemplo, si deseas supervisar diferentes regiones de AWS o cambiar la lista de cuentas de AWS que usa Security Command Center. No puedes modificar los nombres del rol delegado ni del rol recopilador. Si necesitas cambiar estos nombres de roles, debes borrar tu conector de AWS y configurar una nueva conexión.
En la consola de Google Cloud , ve a la página de Security Command Center.
Selecciona la organización en la que activaste Security Command Center Enterprise.
Haz clic en settings Configuración.
Haz clic en la pestaña Conectores.
Haz clic en Editar junto a la conexión que deseas actualizar.
En la página Editar conector de Amazon Web Services, realiza los cambios que desees. En la siguiente tabla, se describen las opciones.
Opción
Descripción
Agrega cuentas de conectores de AWS
Selecciona una opción según tu preferencia:
Agregar cuentas automáticamente (recomendado): Selecciona esta opción para permitir que Security Command Center descubra las cuentas de AWS automáticamente.
Agregar cuentas individualmente: Selecciona esta opción para agregar cuentas de AWS de forma manual.
Excluye cuentas de conectores de AWS
Si seleccionaste Agregar cuentas automáticamente en la sección Agregar cuentas de conector de AWS, proporciona una lista de las cuentas de AWS que Security Command Center no debe usar para encontrar recursos.
Ingresa cuentas de conectores de AWS
Si seleccionaste Agregar cuentas de forma individual en la sección Agregar cuentas de conector de AWS, proporciona una lista de las cuentas de AWS que Security Command Center puede usar para encontrar recursos.
Selecciona regiones para recopilar datos
Selecciona una o más regiones de AWS para que Security Command Center recopile datos. Deja el campo Regiones de AWS vacío para recopilar datos de todas las regiones.
Consultas por segundo (QPS) máximas para los servicios de AWS
Puedes cambiar las QPS para controlar el límite de cuota de Security Command Center. Establece la anulación en un valor inferior al valor predeterminado de ese servicio y mayor o igual que 1.
El valor predeterminado es el valor máximo. Si cambias el QPS, es posible que Security Command Center tenga problemas para recuperar datos. Por lo tanto, no recomendamos cambiar este valor.
Extremo del Servicio de tokens de seguridad de AWS
Puedes especificar un extremo específico para el servicio de tokens de seguridad (STS) de AWS (por ejemplo, https://sts.us-east-2.amazonaws.com). Deja el campo Servicio de tokens de seguridad de AWS vacío para usar el extremo global predeterminado (https://sts.amazonaws.com).
Si cambiaste el ID de la cuenta delegada o la lista de cuentas de AWS para incluir o excluir, debes actualizar tu entorno de AWS. Si cambias el ID de la cuenta delegada, deberás volver a configurar tu cuenta de AWS. Un cambio en la lista de cuentas de AWS requiere que agregues o quites roles de recopilador. Si quitas cuentas de AWS de la lista de exclusiones porque deseas incluirlas, debes agregar los roles de recopilador a esas cuentas.
Completa lo siguiente:
Haz clic en Continuar.
En la página Crear conexión con AWS, completa una de las siguientes opciones:
Si quieres cambiar la configuración de AWS de forma manual, selecciona Usar la consola de AWS. Copia el ID del agente de servicio, el nombre del rol delegado y el nombre del rol del recopilador. Si deseas obtener instrucciones para actualizar AWS de forma manual, consulta Configura cuentas de AWS de forma manual.
Si agregaste una cuenta de AWS a la lista de cuentas de AWS para excluir, te recomendamos que quites el rol de recopilador de la cuenta.
Haz clic en Probar conector para verificar que Security Command Center pueda conectarse a tu entorno de AWS. Si la conexión se realiza correctamente, el agente de servicio Google Cloudpuede asumir el rol delegado, y este tiene todos los permisos necesarios para asumir el rol de recopilador. Si la conexión no se realiza correctamente, consulta Soluciona errores cuando pruebes la conexión.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-04 (UTC)"],[],[],null,["| Enterprise [service tier](/security-command-center/docs/service-tiers)\n\nAfter you connect\n[Security Command Center to Amazon Web Services (AWS)](/security-command-center/docs/connect-scc-to-aws)\nfor configuration and resource data collection, you can modify the connection\nsettings.\n\nBefore you begin\n\nComplete these tasks before you complete the remaining tasks on this page.\n\nSet up permissions in Google Cloud\n\n\nTo get the permissions that\nyou need to use the AWS connector,\n\nask your administrator to grant you the\n\n\n[Cloud Asset Owner](/iam/docs/roles-permissions/cloudasset#cloudasset.owner) (`roles/cloudasset.owner`)\nIAM role.\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nCreate AWS accounts\n\nEnsure that you have the following AWS resources:\n\n- An [AWS IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users.html)\n with [AWS IAM access](https://aws.amazon.com/iam/getting-started/?nc=sn&loc=3)\n for the delegated and collector AWS account consoles.\n\n- The [AWS account ID](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html#FindAccountId)\n for an AWS account that you can use as the delegated account.\n The delegated account must meet the following requirements:\n\n - The delegated account must be attached to an\n [AWS organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#orgs_getting-started_concepts-orgs).\n To attached an account to an AWS organization do the following:\n\n 1. [Create](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_org_create.html) or identify an organization where you will attach the delegated account.\n 2. Invite the delegated account to [join the organization](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_invites.html).\n - The delegated account must be one of the following:\n\n - An [AWS management account](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html).\n - An [AWS delegated administrator](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html).\n - An AWS account with a [resource-based delegation policy](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_delegate_policies.html#orgs-policy-delegate) that provides the `organizations:ListAccounts` permission. For an example policy, see [Create a resource-based delegation policy with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs-policy-delegate.html) in the AWS documentation.\n\nModify the AWS connection\n\nModify an existing AWS connection when your AWS environment configuration\nchanges. For example, you want to monitor different AWS regions, or change the\nlist of AWS accounts that Security Command Center uses. You can't modify the names of\nthe delegated role and the collector role. If you need to change these role\nnames, you must delete your AWS connector and set up a new connection.\n\n1. In the Google Cloud console, go to the Security Command Center page.\n\n [Go to Security Command Center](https://console.cloud.google.com/security/command-center/config/services)\n2. Select the organization that you activated Security Command Center Enterprise on.\n\n3. Click **settings Settings**.\n\n4. Click the **Connectors** tab.\n\n5. Click **Edit** beside the connection that you want to update.\n\n6. In the **Edit Amazon Web Services connector** page, make your changes. The\n following table describes the options.\n\n | Option | Description |\n |-------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n | **Add AWS connector accounts** | Select an option, depending on your preference: - **Add accounts automatically (recommended)**: Select this option to let Security Command Center discover the AWS accounts automatically. - **Add accounts individually**: Select this option to manually add AWS accounts yourself. |\n | **Exclude AWS connector accounts** | If you selected **Add accounts automatically** under the **Add AWS connector accounts** section, provide a list of AWS accounts that Security Command Center should not use to find resources. |\n | **Enter AWS connector accounts** | If you selected **Add accounts individually** under the **Add AWS connector accounts** section, provide a list of AWS accounts that Security Command Center can use to find resources. |\n | **Select regions to collect data** | Select one or more AWS regions for Security Command Center to collect data from. Leave the **AWS regions** field empty to collect data from all regions. |\n | **Maximum queries per second (QPS)** for AWS services | You can change the QPS to control the quota limit for Security Command Center. Set the override to a value that is less than the default value for that service, and greater than or equal to `1`. The default value is the maximum value. If you do change the QPS, Security Command Center might encounter issues fetching data. Therefore, we don't recommend changing this value. |\n | **Endpoint for AWS Security Token Service** | You can specify a specific endpoint for the AWS Security Token Service (for example, `https://sts.us-east-2.amazonaws.com`). Leave the **AWS Security Token Service** field empty to use the default global endpoint (`https://sts.amazonaws.com`). |\n\n7. If you changed the delegated account ID or the list of AWS accounts to\n include or exclude, you must update your AWS environment. A change to the\n delegated account ID requires that you set up your AWS configuration again. A\n change to the list of AWS accounts requires that you add or remove collector\n roles. Removing AWS accounts from the exclude list, because you want to\n include them, requires you to add the collector roles to those accounts.\n Complete the following:\n\n 1. Click **Continue**.\n 2. In the **Create connection with AWS** page, complete one of the\n following:\n\n - Download the CloudFormation templates for the delegated role and the\n collector role. For instructions on using the templates, see\n [Use CloudFormation templates to set up your AWS environment](/security-command-center/docs/connect-scc-to-aws#cloudformation).\n\n - If you want to change the AWS configuration manually, select\n **Use the AWS console** . Copy the service agent ID, delegated role\n name, and the collector role name. For instructions on updating AWS\n manually, see\n [Configure AWS accounts manually](/security-command-center/docs/connect-scc-to-aws#configure-aws-manually).\n\n8. If you added an AWS account to the list of AWS accounts to exclude, we\n recommend that you remove the collector role from the account.\n\n9. Click **Test connector** to verify that Security Command Center can connect to\n your AWS environment. If the connection is successful, the Google Cloud\n service agent can assume the delegated role and the delegated role has all\n the required permissions to assume the collector role. If the connection\n isn't successful, see\n [Troubleshooting errors when testing the connection](/security-command-center/docs/connect-scc-to-aws#troubleshooting-connection).\n\n10. Click **Save**.\n\nWhat's next\n\n- For troubleshooting information, see [Connect Security Command Center to AWS](/security-command-center/docs/connect-scc-to-aws)."]]
