>
    Add the Amazon S3 App
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Onboard Sanctioned SaaS Apps to Data Security
    4. Begin Scanning an Amazon S3 App
    5. Add the Amazon S3 App
    Download PDF
    SaaS Security

    Add the Amazon S3 App

    Table of Contents

    Add the Amazon S3 App

    Add the Amazon S3 app to begin scanning your assets in S3 buckets with Data Security.
    After you set up your scan configuration for a single AWS account or for multiple AWS accounts, add the Amazon S3 app to Data Security to begin scanning your new Amazon S3 app for policy violations.

    Add Amazon S3 App

    There are two methods to set up the Amazon S3 app on Data Security based on whether you are configuring a single account or multiple accounts.
    1. Log in to Strata Cloud Manager
    2. Select ManageConfigurationSaaS SecurityData SecurityApplicationsAdd ApplicationAmazon S3.
    3. Connect a single AWS account, if applicable.
      1. Connect a single AWS account by clicking Connect to Account.
      2. Enter the Access Key ID and Secret Access Key that you noted earlier when you completed the worksheet for your app scan.
      3. Enter the CloudTrail Bucket Name (S3 bucket name) to the default exclusion list.
        Because S3 allows your bucket to be used as a URL that can be accessed publicly, the bucket name that you choose must be globally unique. If some other account has already created a bucket with the name that you chose, you must use another name.
      4. Enter the AWS Account ID.
        To find your AWS account ID number on the AWS Management Console, select Support on the navigation bar on the upper-right, and then select Support Center. Your signed-in account ID displays in the upper-right corner below the Support menu.
      5. Select the Region.
      6. Click OK. Data Security adds the Amazon S3 app to the list of Cloud Apps.
    4. Next Step: Proceed to Customize Amazon S3 App.

    Customize Amazon S3 App

    Customizations include modifying Amazon S3 app name.
    1. Select the Amazon S3 link on the Cloud Apps list.
    2. Enter a descriptive Name to differentiate this instance of Amazon S3 from other instances you are managing.
    3. Click Done to save your changes.
    4. Next Step: Proceed to Identify Risks.

    Identify Risks

    When you add a new cloud app, then enable scanning, Data Security automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
    1. Start scanning the new Amazon S3 app for risks.
    2. Monitor the scan results.
      During the discovery phase, as Data Security scans files and matches them against enabled policy rules, verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
    3. Add policy rules.
      When you add a new cloud app, Data Security automatically scans the app against the default data patterns and displays the match occurrences. As a best practice, consider the business use of your app to determine whether you want to Add a New Data Asset Policy to look for incidents unique to the assets in the new app.
    4. (Optional) Configure or edit a data pattern.
      You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.
    5. If you selected All buckets for inclusion, but do not intend to specify specific buckets for exclusion, start scanning the new Amazon S3 app for risks.
    6. Review exposure details.
      1. To get more details on the exposure, select a Bucket to view the S3 Share Settings. This view displays the bucket policy and access control lists (ACL) with a link to the asset in the associated bucket so that you can get more context into the exposure.

    © 2025 Palo Alto Networks, Inc. All rights reserved.