Amazon S3
  • 02 Oct 2024
  • 3 Minutes to read
  • Contributors

    Amazon S3


      Article summary

      Understanding Data Exporting to S3 bucket

      This article describes the Amazon S3 service and how to configure it. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. You can configure your Harmony SASE data stream to an S3 bucket to have full visibility of your Harmony SASE activity.

      Create a new Bucket

      1. Open the AWS Management Console and select S3.
        360010931659ScreenShot2020-04-12at151541.png
      2. Select Create Bucket.
        360010927040ScreenShot2020-04-12at151107.png
      3. Fill in the following information:
        360010928060ScreenShot2020-04-12at151827.png
      • Bucket name: Enter a name of your choice
        Please note that Perimeter doesn't support "-" or "." (dots), please use letters only.
      • Region: Amazon S3 creates buckets in a Region you specify. To optimize latency, minimize costs, or address regulatory requirements, choose any AWS Region that is geographically close to you.

      360010928140ScreenShot2020-04-12at171713.png

      • Block all public access is checked by default. You may choose to customize it according to your company policy.

      360010932239ScreenShot2020-04-12at171815.png

      • Disable object lock, then select Create bucket.

      Create a new IAM Policy

      Important: At this point, you can choose to grant the user full access to your S3 buckets (by attaching the appropriate AWS managed policy) or create a new policy that applies only to the Harmony SASE bucket. If you choose the first option, you may skip this section.

      1. Open the AWS Identity and Access Management (IAM) dashboard.
      2. Go to the Policies tab and select Create policy.
      3. Paste the following snippet as a JSON file. Replace test with the bucket name, then select Review policy.
        360010947520ScreenShot2020-04-14at100750.png
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": "s3:*",
                  "Resource": "arn:aws:s3:::test"
              },
              {
                  "Effect": "Allow",
                  "Action": "s3:*",
                  "Resource": "arn:aws:s3:::test/*"
              }
          ]
      }
      Important
      The template presented above, while scoped to a single bucket associated with Harmony SASE's logs only, will grant a wide variety of permissions. If for any reason you choose to limit the list of permissions, make sure that at the very least it includes parts highlighted below:
      {
      "Version" : "2012-10-17",
      "Statement" : [
      {
      "Effect" : "Allow" ,
      "Action" : [
      "s3:ListBucket",
      "s3:GetBucketLocation"
      ],
      "Resource" : ["${aws_s3_bucket.pm81-logs.arn}"]
      },
      {
      "Effect" : "Allow" ,
      "Action" : [
      "s3:PutObject" ,
      "s3:GetObject" ,
      "s3:DeleteObject" ],
      "Resource" : ["${aws_s3_bucket.pm81-logs.arn}/*" ]
      }
      ]}

      360010949399ScreenShot2020-04-14at101304.png

      4. Fill in the following information, and then select Create policy.

      • Name: Enter a name of your choice.
      • Description (optional): Let other users in your account know what this policy aims for.

      Create an AWS user

      1. Open the AWS Identity and Access Management (IAM ) dashboard.
      2. Go to the Users tab and select Add user.
        • Username: Enter a name of your choice. And select next.
      3. Select Attach existing policies directly and choose the policy you created earlier (if you skipped the previous section, select the S3 full access AWS managed policy). Select Next.

      Create an AWS access key

      1. Open the AWS Identity and Access Management (IAM ) dashboard.
      2. Navigate to the Users tab and select the user you have created.
      3. Navigate to the Security credentials tab
      4. Scroll down to Access keys and select Create access key 
      5. Choose Application running outside AWS and click next
      6. Choose Create access key (you can add Description tag value if you like)
      7. Copy the Secret access key and the Access key 

      Connect the S3 bucket to Harmony SASE

      1. Log in to your Harmony SASE Management Platform, and navigate to Settings/Integrations, and select Add at the Amazon S3 row.
        360011062679ScreenShot2020-04-16at105728.png
      2. Fill in according to the values copied in the previous steps (the primary key will be used as your workspace key)
        • Access key ID = Access key (copied from AWS)  
        • Secret access key = Secret access key (copied from AWS)
        • Bucket = Your S3 Bucket Identifier (for example- if your bucket name is "arn:aws:s3:::tests3bucket", you will only need to input "tests3bucket")
        • Bucket region = The region you chose in the first step
      3. Select Validate.

      Recommendations

      • Ensure that the IAM user has the necessary permissions to access the S3 bucket.
      • Regularly review and update your S3 bucket settings to align with your organization's security policies.
      • When setting up the integration, double-check the provided AWS credentials to avoid connectivity issues
      Harmony SASE uses these IP addresses to deliver SIEM logs


      • US tenant:
        • 44.199.0.186
        • 44.198.227.127
        • 50.19.134.176
        • 23.20.83.77
        • 54.85.165.134
      • EU tenant:
        • 52.50.186.78
        • 79.125.50.175
        • 34.246.127.40

      Troubleshooting

      Status messageAction required
      SuccessNone
       S3_INVALID_ACCESS_KEY_IDMake sure you copied correctly the access key ID
      S3_INVALID_SECRET_ACCESS_KEYMake sure you copied correctly the secret access key.
      S3_INVALID_BUCKETMake sure the Bucket name in Harmony SASE matched the Bucket name in S3 (case sensitive).
      S3_ACCESS_DENIED_BUCKET

      The IAM user doesn't have the required access permissions to the bucket. Make sure to attach the appropriate policy.

      Support Contacts

      If you have any difficulties or questions, don't hesitate to contact Harmony SASE's support team. We offer 24/7 chat support on our website at Perimeter81.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success.


      Was this article helpful?