Configure Cloud Storage on AWS for Panorama

Log in to the Amazon AWS console.
Create a public S3 storage bucket to store files scanned by the
Enterprise DLP
cloud service.
Select
Services
Storage
S3
Buckets
and
Create bucket
.
Enter a descriptive
Bucket name
.
Select the
AWS Region
for the S3 bucket.
In the Default encryption section,
Enable
server-side encryption and select the default
Amazon S3 key (SSE-S3)
encryption key type.
This is required to successfully associate the S3 bucket with the hub.

Create bucket
.
Create the IAM role for the S3 bucket.
This role is required to allow the DLP cloud service to write to the S3 bucket.
Select
Services
Security, Identity, and Compliance
IAM
Access management
Roles
and
Create role
.
For the type of trusted entity, select
S3
from the list displayed in the Choose a use case section.
In the Select your use case section, select
S3
.
Select
Next: Permissions
,
Next: Tags
and
Next: Review
.
The permissions policy to create the trust relationship is configured the following step.
Enter a descriptive
Role name
for the IAM role.
Create role
.
Configure the trust relationship for the IAM role.
Obtain the trust relationship using JSON provided by Palo Alto Networks.
Log in to the DLP app on the hub.
Select
Settings
Sensitive Data
and select
Configure Bucket
AWS
as the Cloud Storage Bucket for Evidence Storage.
In the
Instructions
, copy the JSON provided to define the trust relationship between the IAM role and Palo Alto Networks.

In AWS, select
Services
Security, Identity, and Compliance
IAM
Access management
Roles
and select the IAM role you created.
Select
Trust relationships
and
Edit trust relationship
.
Paste the trust relationship JSON you copied from the DLP app in the hub to define the trust relationship between the IAM role and Palo Alto Networks.

Update Trust Relationship
.
Create a policy to define the access policy and assign the policy to the IAM role you created.
Palo Alto Networks provides you with a JSON containing the required access policy configuration that you can copy and paste.
Obtain the access policy using JSON provided by Palo Alto Networks.
Log in to the DLP app on the hub
Select
Settings
Sensitive Data
and select
Configure Bucket
AWS
as the Public Cloud Storage Bucket.
In the
Instructions
, copy the JSON provided to define the access policy between the IAM role and Palo Alto Networks.

In AWS, select
Services
Security, Identity, and Compliance
IAM
Access management
Policies
and
Create policy
.
Select
JSON
and pasted the JSON provided by Palo Alto Networks.
Throughout the JSON, you must delete all instances of
bucket_name_to_be_replaced
with the S3 bucket ARN you created.
You can find the ARN of your S3 bucket by selecting
Services
Storage
S3
. Then select the S3 bucket and view the
Properties
.

Select
Next: Tags
and
Next: Review
Enter a descriptive
Name
for the access policy and
Create policy
.
Select
Roles
and select the IAM role you created.
Select
Permissions
Attach policies
to select the access policy you created and
Attach policies
.
Configure the S3 bucket for evidence file storage.
Log in to the DLP app on the hub.

If you do not already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.

Access to evidence storage settings and files on the hub is allowed only for an account administrator or app administrator roles with a valid

Enterprise DLP

license associated with that support account. This is to ensure that only the appropriate users have access to report data and evidence.

Select

Settings

Sensitive Data

and select

Configure Bucket

AWS

as the Public Cloud Storage Bucket .

Input Bucket Details

.

Enter the

S3 Bucket Name

of the bucket you created.

Enter the

Role ARN

for the IAM role you created.

Select the AWS

Region

where the bucket is located.



Select

Next

to verify the connections status your S3 bucket.

Select

Save

if the hub can successfully connect your bucket. A

connectiontest

file is uploaded to your storage bucket by the DLP cloud service to verify connectivity.

If the hub cannot successfully connect your bucket, select

Previous

and edit the bucket connection settings.

In the DLP

Settings

,

Enable

storage of sensitive files for the platform in which you are leveraging

Enterprise DLP

.

You can only enable storage of sensitive files for platform for which you have activated the

Enterprise DLP

license. For example, you only have the option to enable evidence storage for Next-Generation Firewalls if you activated the

Enterprise DLP

license on Panorama.


Download Files for Evidence Analysis on Panorama.