Forward Logs to AWS S3 Bucket

1. Create and configure the Amazon S3 bucket in the AWS Management Console.
2. Enable communication between Strata Logging Service and your AWS S3 bucket.
3. Create an Identity and Access Management (IAM) role to permit write access to the Amazon Security Lake bucket location.

   1. In the AWS Management Console navigation pane of the console, click RolesCreate role.
   2. In the Select trusted entity page, select AWS accountAn AWS accountAnother AWS account and enter Account ID provided by Palo Alto Networks. Refer to the value provided in the AWS ACCOUNT ID field. This allows your AWS account to assume this role, and share the logs to the desired destination. Contact Palo Alto Networks customer support to get the Account ID you need to use here.
   3. Select Require external ID and enter a password to establish connection between Amazon Security Lake and Strata Logging Service.
   4. Create policy or use an existing policy in the Add permissions page.

      1. When you create a new policy, select JSON as the Policy Editor
      2. Edit the following code to replace DOC-EXAMPLE-BUCKET1 and DOC-EXAMPLE-BUCKET1/* with your Amazon S3 bucket name.

         ⦁	{
             "Version":"2012-10-17",
             "Statement":[
                {
                  "Effect":"Allow",
                   "Action":"s3:PutObject",
                  "Resource": [
                        "arn:aws:s3:::DOC-EXAMPLE-BUCKET1",
                        "arn:aws:s3:::DOC-EXAMPLE-BUCKET1/*"
                  ]
                 }
              ]
         } 
         

      3. Enter a policy name and create policy.
   5. Provide a role name and save the changes.
   6. In the Roles page, select the role you created and copy and save the IAM Role ARN. You need to use the same ARN when configuring the log forwarding profile.
4. Sign In to the hub.
5. Select the Strata Logging Service instance that you want to configure for log forwarding.

   If you have multiple Strata Logging Service instances, click the Strata Logging Service tile and select an instance from the list of those available.

   If you're using Strata Cloud Manager to manage Strata Logging Service, click SettingsStrata Logging ServiceLog Forwarding forward logs to an external server.
6. Select Log ForwardingAWS S3 + to add a new Amazon S3 profile in Strata Logging Service.

7. Configure the log forwarding profile to forward logs to the AWS S3 bucket.

   1. Enter a descriptive Name for the profile.
   2. Enter the name of the Amazon S3 configured bucket that is used as the storage container for your forwarded log data. You can get the name from the Amazon Console.
   3. Enter the geographic region (regional code) where the Amazon S3 bucket is located.
   4. Select the external identification method to authenticate the Amazon S3 bucket.

      • IAM Role
        • IAM Role ARN - The Amazon Resource Names (ARN) of the role that has access to the Amazon S3 bucket. Enter the ARN you saved in step 2.f. The IAM Role ARN needs to be in the following format: arn:partition:service:region:account-id:resource-type:resource-id
        • External ID - The external identifier that you defined while linking the IAM role to your Amazon account.
      • Access Key- If you have created a long-term access key to authenticate your AWS account, enter the key and secret password here.

        • To create an access key for the Amazon S3 bucket:
          1. Log in to AWS Management Console with your AWS account ID.
          2. On the Console Home page, select the IAM service.
          3. Select Users and then select Create user from the navigation pane.
          4. On the Specify user details page, enter the name for the new user.
          5. Do not select Provide user access to the – AWS Management Console and click Next.
          6. Set Permissions for the user. Here is a sample of the JSON code to set the permission boundaries in the policy:

             {
                 "Version": "2012-10-17",
                 "Statement": [ 
                     {
                        "Effect": "Allow",
                        "Action": "s3:PutObject",
                        "Resource": [
                            "arn:aws:s3:::DOC-EXAMPLE-BUCKET1",
                            "arn:aws:s3:::DOC-EXAMPLE-BUCKET1/*"
                           ]
                       }
                    ]
             }
             

          7. Review the selection and create the user.
          8. In the Summary page, select Security credentials > Create Access Key.
          9. Select the Third-party service option as the reason for enabling the access key and confirm the recommendation to create the access key.
          10. Retrieve the access key and use it while configuring the log forwarding.
8. Use this AWS Account ID to connect to the AWS S3 bucket.
9. Test Connection to ensure that the Strata Logging Service can communicate with the receiver.

   This sends an empty log to the sls_test_events folder in the configured destination to verify that transmission is possible.

   If the test fails, you won't be able to proceed.
10. Click Next.
11. Specify the Payload Format as JSON - the log format in which the Strata Logging Service forwards logs.
12. (Optional) To receive a STATUS NOTIFICATION when the Strata Logging Service is unable to connect to the Amazon S3 bucket, enter the email address at which you’d like to receive the notification.

    You will continue to receive these notifications at least once every 60 minutes until connectivity is restored. If the connectivity issue is addressed within 72 hours, no logs will be lost. However, service disconnection could lead to the loss of any logs older than 72 hour.
13. Add the type of log you want to forward and optionally write a query to create filter to forward only the logs that are most critical to you. Save your changes

    If you want to forward all logs of the type you selected, do not enter a query.
14. Save your changes.
15. Verify that the Status of your forwarding profile is Running (

    ).
16. Verify if the logs are forwarded to the destination location. This is a sample path: /Amazon S3 bucket location > folder name > logsource.logtype > year > month > date.
17. (Optional) You can use the running Amazon S3 forwarding profile to forward past logs spanning up to 3 days.