Scan a Single Amazon S3 Account

1. Log in to your AWS Console aws.amazon.com.
2. Select ServicesSecurity, Identity & ComplianceIAM.
3. Configure the Data Security policy used to connect to the Amazon S3 app.

   1. Select PoliciesCreate policy and then select Create Your Own Policy.
   2. Enter the Policy Name as prisma-saas-s3-policy and provide an optional description of the policy.
   3. Copy and paste the following configuration into the Policy Document section:

      {  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:Get*",        "s3:List*",        "s3:Put*",        "s3:Delete*",        "s3:CreateBucket",        "iam:GetUser",        "iam:GetRole",        "iam:GetUserPolicy",        "iam:ListUsers",        "cloudtrail:GetTrailStatus",        "cloudtrail:DescribeTrails",        "cloudtrail:LookupEvents",        "cloudtrail:ListTags",        "cloudtrail:ListPublicKeys",        "cloudtrail:GetEventSelectors",        "ec2:DescribeVpcEndpoints",        "ec2:DescribeVpcs",        "config:Get*",        "config:Describe*",        "config:Deliver*",        "config:List*"      ],      "Resource": "*"    }  ]}

   4. Click Create Policy.
4. Configure the account that Data Security will use to access the Amazon S3 logs:

   1. Select UsersAdd user.
   2. Enter the user name as prisma-saas-s3-user.
   3. To generate an access key ID and secret access key for Data Security to use to access the Amazon S3 service, enable Programmatic access.
   4. Select Next: Permissions.
   5. Select Attach existing policies directly.
   6. Search for and select the check box next to the prisma-saas-s3-policy you created in the previous step.
   7. Click Next: ReviewCreate User.

      Note your Access key ID and Secret access key.
   8. Click Close.
5. Configure CloudTrail logging, if you have not already done so.

   CloudTrail logging enables the Amazon S3 app to log management and data events to the CloudTrail buckets of your choice.

   1. Copy your AWS account ID into memory by clicking on your username at the top right and copy the account number.

      You will need your account number later in this procedure.
   2. Select ServicesManagement ToolsCloudTrailTrailsAdd new trail.
   3. Enter the Trail name prisma-saas-s3-trail.
   4. Set Apply trail to all Regions to Yes.
   5. In Data events, specify which S3 buckets you want Data Security to scan:

      • Individual buckets—Operates as an allow list and requires ongoing maintenance.
   6. To create a bucket in which CloudTrail will store management and data event logs, enter the S3 bucket name as prisma-saas-s3-<AWS account ID> in the Storage location area.

      Take note of the S3 bucket (CloudTrail bucket name) and region.
   7. Click Create.
6. Next Step: Proceed to Onboard Sanctioned SaaS Apps to Data Security.

Cross Account Scan Multiple Amazon S3 Accounts

1. Configure CloudTrail logging on the primary account.

   1. Log in to your AWS Console aws.amazon.com.
   2. Select ServicesCloudTrailTrailsCreate Trail.
   3. Enter the Trail name prisma-saas-s3-primary-trail.
   4. Set Apply trail to all Regions to Yes.
   5. In Data events, specify which S3 buckets in your primary account you want Data Security to scan:

      • All S3 buckets—Enables you to include current and future buckets without maintenance. With this option, you can exclude buckets later in the SaaS Security web interface.
      • Individual buckets—Operates as an allow list and requires ongoing maintenance.
   6. In the Storage location area, create a bucket in which CloudTrail will store management and data event logs, enter the S3 bucket name as prisma-saas-s3-<AWS account ID>.

      You can also use an existing bucket for the log storage location, if one exists.

2. Configure a user in the primary account that will access each of the secondary accounts.

   1. Select ServicesIAM.
   2. Select UsersAdd user.
   3. Enter the user name as prisma-saas-s3-user.
   4. Select Programmatic access to generate an access key ID and secret access key for Data Security to use to access the Amazon S3 service.
   5. Select Next: Permissions.
   6. Create a user policy.

      1. Select Attach existing policies directlyCreate Policy. A new window will open. You will attach this policy to the user account that authorizes Data Security to scan the Amazon S3 accounts.
      2. Click the JSON tab and copy and paste the following configuration into the Policy Document section:

      {
       "Version": "2012-10-17",
       "Statement": [
        {
         "Effect": "Allow",
         "Action": [
          "s3:Get*",
          "s3:List*",
          "s3:Put*",
          "s3:Delete*",
          "s3:CreateBucket",
          "iam:GetUser",
          "iam:GetRole",
          "iam:GetUserPolicy",
          "iam:ListUsers",
          "cloudtrail:GetTrailStatus",
          "cloudtrail:DescribeTrails",
          "cloudtrail:LookupEvents",
          "cloudtrail:ListTags",
          "cloudtrail:ListPublicKeys",
          "cloudtrail:GetEventSelectors",
          "ec2:DescribeVpcEndpoints",
          "ec2:DescribeVpcs",
          "config:Get*",
          "config:Describe*",
          "config:Deliver*",
          "config:List*"
         ],
         "Resource": "*"
        },
        {
         "Effect": "Allow",
         "Action": "sts:AssumeRole",
         "Resource": "arn:aws:iam::111111111:role/prisma-saas-s3-cross-account-access-role"
        },
        {
         "Effect": "Allow",
         "Action": "sts:AssumeRole",
         "Resource": "arn:aws:iam::222222222:role/prisma-saas-s3-cross-account-access-role"
        },
        {
         "Effect": "Allow",
         "Action": "sts:AssumeRole",
         "Resource": "arn:aws:iam::333333333:role/prisma-saas-s3-cross-account-access-role"
        }
       ]
      }

      This policy document has three pseudo secondary accounts 222222222,111111111,333333333 referenced in it. You will need to edit the policy to reflect the account numbers of each of your secondary accounts.
   7. Click Review Policy and enter the Policy Name as prisma-saas-s3-primary-policy and provide an optional description of the policy.
   8. Click Create Policy.
   9. Refresh the first window and select prisma-saas-s3-primary policy, and click NextReview and then Create User.

      Note the Access key ID and Secret access key for the user. You will need these numbers later in this setup.
   10. Click Close.
3. Configure the CloudTrail bucket in the primary account to give CloudTrail service access to each secondary account prefix.

   1. Log in to your AWS Console aws.amazon.com.
   2. Select ServicesS3.
   3. Select the CloudTrail S3 bucket you just created, for example prisma-saas-s3-[aws account id].
   4. Select PermissionsBucket Policy.
   5. Verify that the bucket policy has a Statement to Allow Action S3:PutObject for the primary account prefix, for example, “Resource”: “arn:aws:s3:::prisma-saas-s3-[aws account id]/AWSLogs/[aws account id]/*”,
   6. Modify this resource entry to add the account prefix for each secondary account, similar to the following:

      	"Resource": 
      	[              
      	"arn:aws:s3:::prisma-saas-s3-[aws account id]/AWSLogs/[aws account id]/*",              
      	"arn:aws:s3:::prisma-saas-s3-[aws account id]/AWSLogs/111111111/*",              
      	"arn:aws:s3:::prisma-saas-s3-[aws account id]/AWSLogs/222222222/*",              
      	"arn:aws:s3:::prisma-saas-s3-[aws account id]/AWSLogs/333333333/*"          
      	],

   7. Save the resource modification.
4. Configure a role and an associated policy on each secondary account.

   1. Log in to your AWS Console aws.amazon.com.
   2. Configure an IAM role by selecting IAMRolesCreate Role.
   3. Select Another AWS Account Type as type of trusted entity.
   4. Enter the AWS account number of your primary account in Specify accounts that can use this role. Leave the other Options unchecked and select Next: Permissions.
   5. Click Create Policy and a new window will open.
   6. Click the JSON tab and copy and paste the following configuration into the Policy Document section:

      	{
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "s3:Get*",
                      "s3:List*",
                      "s3:Put*",
                      "s3:Delete*",
                      "s3:CreateBucket",
                      "iam:GetUser",
                      "iam:GetRole",
                      "iam:GetUserPolicy",
                      "iam:ListUsers",
                      "cloudtrail:GetTrailStatus",
                      "cloudtrail:DescribeTrails",
                      "cloudtrail:LookupEvents",
                      "cloudtrail:ListTags",
                      "cloudtrail:ListPublicKeys",
                      "cloudtrail:GetEventSelectors",
                      "ec2:DescribeVpcEndpoints",
                      "ec2:DescribeVpcs",
                      "config:Get*",
                      "config:Describe*",
                      "config:Deliver*",
                      "config:List*"
                  ],
                  "Resource": "*"
              }
          ]
      }

   7. Click Review Policy and enter the Policy Name as prisma-saas-s3-secondary-policy and provide an optional description of the policy.
   8. Click Create Policy.
   9. Refresh the policy window and select prisma-saas-S3-secondary-policy.
   10. Select Next: Review and enter the role name prisma-saas-s3-cross-account-access-role.
   11. Create the role by entering in Role name. Before creating the role, verify the following:

       1. Trusted entities contain the primary account number.
       2. prisma-saas-s3-secondary-policy displays in Policies.
       3. When verification is complete, click Create Role.
   12. Select the role just created and copy the role ARN into memory (for example arn:aws:iam::222222222:role/prisma-saas-s3-cross-account-access-role). You will need the role ARN later in this procedure.
5. Configure CloudTrail on each secondary account to associate with the primary account.

   1. Select ServicesCloudTrailTrailsCreate trail.
   2. Enter the Trail name prisma-saas-s3-secondary-trail.
   3. Set Apply trail to all Regions to Yes.
   4. In Data events, specify which S3 buckets in your secondary account you want Data Security to scan:

      • All S3 buckets—Enables you to include current and future buckets without maintenance. With this option, you can exclude buckets later in the SaaS Security web interface.
      • Individual buckets—Operates as an allow list and requires ongoing maintenance.
   5. To configure a bucket in which CloudTrail will store management and data event logs for this account, enter the bucket name of the CloudTrail bucket in the primary account, for example prisma-saas-s3-<AWS account ID> in the Storage location area and click Create.

6. Next Step: Add the Amazon S3 App.

Add the Amazon S3 App

Exclude Amazon S3 Buckets from Scans

1. Log in to SaaS Security
2. Select SettingsCloud Apps & Scan Settings.
3. Click on the Amazon S3 app that you added.
4. Specify a comma-separated list of bucket names in Custom List of Buckets to Exclude, then Add.

5. Next Step: Start scanning, when you’re ready for Data Security to discover your assets.