Additional Configuration Options
Suppress TAP Dashboard Asset Logging
AWS API Request Logging
Combine can log AWS API Requests passing through it to a DynamoDB table for auditing and analysis.
FIPS Endpoints
The Federal Information Processing Standard (FIPS) 140 defines security requirements for cryptographic modules used to protect sensitive information.
IAM User Credential Lookup
While IAM Users are not frequently allowed by the sponsors of emulated Partitions, there are occasional scenarios where they are needed. When Combine is proxying a Request it needs to infer the IAM Credentials that signed that Request (see Orientation for a summary of this process under the Rewriting section).
Kubernetes Proxy Access Control
The Combine Kubernetes Proxy can be configured to allow or deny requests based on the source IP address (CIDR block) or the IAM Role ARN used to sign the request.
PKI Certificate Parameters
Combine's PKI certificate settings — such as key size, signing algorithm, and certificate encryption — can be customized through Combine Configuration.
PKI Certificates: CSR Signing API
Combine provides an API for Signing CSR Requests. This API is not an emulation and it is not available in the production environment. It solely exists to facilitate customers who want to use a CSR but also do not want to manually upload each CSR to Combine.
PKI Certificates: OCSP Support
Combine Version 3.13.2 added support for OCSP and provides an OCSP Responder Endpoint through the TAP Dashboard servers.
Resource Role Masquerade
Resource Role Masquerade allows Combine to assume the IAM role attached to an AWS resource (such as an EC2 instance profile or Lambda execution role) when evaluating access for that resource. This enables more accurate emulation of resource-based access patterns.
User-Agent Header Injection
Combine can inject a SequoiaCombine/ string into the User-Agent header of each AWS API Call it handles. This allows downstream AWS services or logging systems to identify traffic that has passed through Combine.
VPC Wrapping
Combine will support deploying to an already existing VPC by "wrapping" it with Combine. This allows Combine to be deployed without permissions to create network resources.