Amazon S3
  • 03 Nov 2020
  • 2 Minutes To Read
  • Contributors
  • Print
  • Dark
    Light

Amazon S3

  • Print
  • Dark
    Light

This article describes the Amazon S3 service and how to configure it. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. You can configure your Perimeter 81 data stream to an S3 bucket to have full visibility of your Perimeter 81 activity.

  • Creating a new bucket
  • Creating a new IAM Policy
  • Creating an AWS Access Key
  • Connecting the S3 bucket to Perimeter 81
  • Dealing with possible error codes

Create a new Bucket

  1. Open the AWS Management Console and select S3.
    360010931659ScreenShot2020-04-12at151541.png
  2. Select Create Bucket.
    360010927040ScreenShot2020-04-12at151107.png
  3. Fill in the following information:
    360010928060ScreenShot2020-04-12at151827.png
  • Bucket name: Select the name of your own choice.
  • Region: Amazon S3 creates buckets in a Region you specify. To optimize latency, minimize costs, or address regulatory requirements, choose any AWS Region that is geographically close to you.

360010928140ScreenShot2020-04-12at171713.png

  • Block all public access is checked by default. You may choose to customize it according to your company policy.

360010932239ScreenShot2020-04-12at171815.png

  • Disable object lock, then select Create bucket.

Create a new IAM Policy

Important: At this point, you can choose to grant the user full access to your S3 buckets (by attaching the appropriate AWS managed policy) or create a new policy that applies only to the Perimeter 81 bucket. If you choose the first option, you may skip this section.

  1. Open the AWS Identity and Access Management (IAM) dashboard.
  2. Go to the Policies tab and select Create policy.
  3. Paste the following snippet as a JSON file. Replace test with the bucket name, then select Review policy.
    360010947520ScreenShot2020-04-14at100750.png
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        }
    ]
}


Important
The template presented above, while scoped to a single bucket associated with Perimeter 81's logs only, will grant a wide variety of permissions. If for any reason you choose to limit the list of permissions, make sure that at the very least it includes parts highlighted below:
{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow" ,
"Action" : [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource" : ["${aws_s3_bucket.pm81-logs.arn}"]
},
{
"Effect" : "Allow" ,
"Action" : [
"s3:PutObject" ,
"s3:GetObject" ,
"s3:DeleteObject" ],
"Resource" : ["${aws_s3_bucket.pm81-logs.arn}/*" ]
}
]}

360010949399ScreenShot2020-04-14at101304.png

4. Fill in the following information, and then select Create policy.

  • Name: Choose the name of your own choice.
  • Description (optional): Let other users in your account know what this policy aims for.

Create an AWS access key

  1. Open the AWS Identity and Access Management (IAM ) dashboard.
  2. Go to the Users tab and select Add user.
    360010947420ScreenShot2020-04-14at100028.png
  3. Fill in the following information, then select Next.
    360010949179ScreenShot2020-04-14at100250.png
  • Username: Choose the name of your own choice.
  • Access type: Select Programmatic access.
  1. Select Attach existing policies directly and choose the policy you created earlier (if you skipped the previous section, select the S3 full access AWS managed policy). Select Next.
    360010949979ScreenShot2020-04-14at104210.png
  2. Add tags you may find useful in identifying the user (optional), then select Next.
    360010948440ScreenShot2020-04-14at104436.png
  3. Review and select Create user.
  4. Copy and save the Access key ID and the Secret access key, then select close.
    360010950359ScreenShot2020-04-14at104827.png

Connect the S3 bucket to Perimeter 81

  1. Log in to your Perimeter 81 Management Platform, and navigate to Settings/Integrations, and select Add at the Amazon S3 row.
    360011062679ScreenShot2020-04-16at105728.png

  2. Fill in according to the values copied in the previous steps (the primary key will be used as your workspace key).

  3. Select Validate.

Handling possible error codes

Status messageAction required
SuccessNone
 S3_INVALID_ACCESS_KEY_IDMake sure you copied correctly the access key ID
S3_INVALID_SECRET_ACCESS_KEYMake sure you copied correctly the secret access key.
S3_INVALID_BUCKETMake sure the Bucket name in Perimeter 81 matched the Bucket name in S3 (case sensitive).
S3_ACCESS_DENIED_BUCKET

The IAM user doesn't have the required access permissions to the bucket. Make sure to attach the appropriate policy.