Data Security enables you to exclude specific
S3 buckets from scans to meet your organization’s compliance needs.
Sometimes organizations designate specific S3 buckets to store data
that is not in use before that data moves to
cold storage
(for example, Amazon Glacier). If you have compliance reporting
demands when such data is accessed, you can omit that data from
scans.
Data Security has two exclusion lists:
- Default
exclusion list—S3 buckets that Data Security automatically
excludes from scans. CloudTrail logging enables the Amazon S3 to
log management and data events to the CloudTrail buckets. Data Security depends on the CloudTrail to identify changes in the S3 account
and buckets. Your log events do not display as assets in the Data Security web interface because the bucket that you specify in CloudTrail
Bucket Name or Primary CloudTrail Bucket
Name during onboarding will not be scanned. These bucket
names display in the SaaS Security web interface under Buckets
Ignored.
- Custom exclusion list—S3 buckets that you manually exclude
from scans. If you specify All S3 buckets
during single account or multiple accounts onboarding,
you have the option to add a custom list of S3 buckets for exclusion.
In
order for
Data Security to enforce your custom exclusion list,
you must add the bucket names after you onboard the Amazon S3 app—but
before you
start scanning.
Otherwise, absent any bucket names,
Data Security scans
All S3
buckets, then displays those unwanted assets in the SaaS Security
web interface. If you add the bucket names
after the scan
begins,
Data Security stops scanning those buckets moving forward,
but those unwanted assets remain in
Data Security. To remove
those assets, you must delete the Amazon S3 app and repeat the onboarding
process. Similarly, you can delete a bucket name from exclusion,
but previously discovered assets remain unless you
delete the cloud app.
