Add Amazon S3 App

1. To add the Amazon S3 app to Data Security, go to Data SecurityApplicationsAdd ApplicationAmazon S3.

2. Connect a single AWS account, if applicable.

   1. Connect a single AWS account by clicking Connect to Account.
   2. Enter the Access Key ID and Secret Access Key that you noted earlier when you completed the worksheet for your app scan.
   3. Enter the CloudTrail Bucket Name (S3 bucket name) to the default exclusion list.

      Because S3 allows your bucket to be used as a URL that can be accessed publicly, the bucket name that you choose must be globally unique. If some other account has already created a bucket with the name that you chose, you must use another name.
   4. Enter the AWS Account ID.

      To find your AWS account ID number on the AWS Management Console, select Support on the navigation bar on the upper-right, and then select Support Center. Your signed-in account ID displays in the upper-right corner below the Support menu.
   5. Select the Region.
   6. Click OK. Data Security adds the Amazon S3 app to the list of Cloud Apps.

3. Connect multiple AWS accounts, if applicable.

   AWS enables you to combine CloudTrail log files from multiple AWS regions and separate accounts into a single S3 bucket. Aggregating your log files in a single bucket simplifies storage and management of your Trails.

   1. Enter the Primary Account Access Key ID and Primary Account Secret Access Key that you noted earlier when you completed the worksheet for your app scan.
   2. Enter the Primary AWS Account ID.

      To find your AWS account ID number on the AWS Management Console, select Support on the navigation bar on the upper-right, and then select Support Center. Your signed-in account ID displays in the upper-right corner below the Support menu.
   3. Enter the Shared IAM Role.

      The shared IAM role delegates access to resources in different AWS accounts that you own (Production and Development). By configuring cross-account access with a role, you don't need to create individual IAM users in each account. In addition, users don't have to sign out of one account and sign into another in order to access resources that are in different AWS accounts.
   4. Enter the Primary CloudTrail Bucket Name (S3 bucket name).

      Because S3 allows your bucket to be used as a URL that can be accessed publicly, the bucket name that you choose must be globally unique. If some other account has already created a bucket with the name that you chose, you must use another name.
   5. Select the Primary CloudTrail Bucket Region.
   6. In Secondary Account Configuration select a CloudTrail configuration:

      • Centralized CloudTrail— logging for all AWS accounts goes to a single CloudTrail bucket in the primary account. Enter one Amazon account per line with no delimiters.
      • Distributed CloudTrail— logging for each AWS account goes to a separate CloudTrail bucket in the account’s location. Enter one Amazon Account: Bucket Name: Region per line with a colon ( : ) as a delimiter.

      If you are configuring both centralized and distributed CloudTrails, use Distributed CloudTrail.
   7. Click OK to add the Amazon S3 app to the list of Cloud Apps on Data Security.

4. Next Step: Proceed to Customize Amazon S3 App.