Configure Cloud Storage on AWS for Prisma Access (Cloud Managed)

Log in to the Amazon AWS console.
Create a public S3 storage bucket to store files scanned by the Enterprise DLP cloud service.
Select
Services
Storage
S3
Buckets
and
Create bucket
.
Enter a descriptive
Bucket name
.
Select the
AWS Region
for the S3 bucket.
In the Default encryption section,
Enable
server-side encryption and select your preferred encryption key type.
This is required to successfully associate the S3 bucket with the hub.

Create bucket
.
Create the IAM role for the S3 bucket.
This role is required to allow the DLP cloud service to write to the S3 bucket.
Select
Services
Security, Identity, and Compliance
IAM
Access management
Roles
and
Create role
.
For the type of trusted entity, select
S3
from the list displayed in the Choose a use case section.
In the Select your use case section, select
S3
.
Select
Next: Permissions
,
Next: Tags
and
Next: Review
.
The permissions policy to create the trust relationship is configured the following step.
Enter a descriptive
Role name
for the IAM role.
Create role
.
Configure the trust relationship for the IAM role.
Obtain the trust relationship using JSON provided by Palo Alto Networks.
Launch the Prisma Access Cloud Management.
Select
Manage
Configuration
Security Services
Data Loss Prevention
Settings
Sensitive Data
and select
AWS
as the Public Cloud Storage Bucket.
In the
Instructions
, copy the JSON provided to define the trust relationship between the IAM role and Palo Alto Networks.

In AWS, select
Services
Security, Identity, and Compliance
IAM
Access management
Roles
and select the IAM role you created.
Select
Trust relationships
and
Edit trust relationship
.
Paste the trust relationship JSON you copied from Prisma Access (Cloud Managed) to define the trust relationship between the IAM role and Palo Alto Networks.

Update Trust Relationship
.
Create a policy to define the access policy and assign the policy to the IAM role you created.
Palo Alto Networks provides you with a JSON containing the required access policy configuration that you can copy and paste.
Obtain the access policy using JSON provided by Palo Alto Networks.
Log in to the DLP app on the hub
Select
Manage
Configuration
Security Services
Data Loss Prevention
Settings
Sensitive Data
and select
AWS
as the Public Cloud Storage Bucket.
In the
Instructions
, copy the JSON provided to define the access policy between the IAM role and Palo Alto Networks.

In AWS, select
Services
Security, Identity, and Compliance
IAM
Access management
Policies
and
Create policy
.
Select
JSON
and pasted the JSON provided by Palo Alto Networks.
Throughout the JSON, you must delete all instances of
bucket_name_to_be_replaced
with the S3 bucket ARN you created.
You can find the ARN of your S3 bucket by selecting
Services
Storage
S3
. Then select the S3 bucket and view the
Properties
.

Select
Next: Tags
and
Next: Review
Enter a descriptive
Name
for the access policy and
Create policy
.
Select
Roles
and select the IAM role you created.
Select
Permissions
Attach policies
to select the access policy you created and
Attach policies
.
Configure the S3 bucket for evidence file storage.
Launch the Prisma Access Cloud Management.
Access to evidence storage settings and files on Prisma Access (Cloud Managed) is allowed only for an account administrator or app administrator role with Enterprise DLP read and write privileges. This is to ensure that only the appropriate users have access to report data and evidence.
Select
Manage
Configuration
Security Services
Data Loss Prevention
Settings
Sensitive Data
and select
AWS
as the Public Cloud Storage Bucket.
Input Bucket Details
.
Enter the
S3 Bucket Name
of the bucket you created.
Enter the
Role ARN
for the IAM role you created.
Select the AWS
Region
where the bucket is located.

Select
Next
to verify the connections status your S3 bucket.
Select
Save
if Prisma Access (Cloud Managed) can successfully connect your bucket. A
connectiontest
file is uploaded to your storage bucket by the DLP cloud service to verify connectivity.
If Prisma Access (Cloud Managed) cannot successfully connect your bucket, select
Previous
and edit the bucket connection settings.
In the Store Sensitive Files settings, enable storage of sensitive files for Prisma Access (Cloud Managed).
Download Files for Evidence Analysis on Prisma Access (Cloud Managed).