Amazon S3

Understanding Data Exporting to S3 bucket

This article describes the Amazon S3 service and how to configure it. Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. You can configure your Check Point SASE data stream to an S3 bucket to have full visibility of your Check Point SASE activity.

Create a new Bucket

1. Open the AWS Management Console and select S3.
   
2. Select Create Bucket.
   
3. Fill in the following information:
   

• Bucket name: Enter a name of your choice
  Please note that Check Point SASE doesn't support "-" or "." (dots), please use letters only.
• Region: Amazon S3 creates buckets in a Region you specify. To optimize latency, minimize costs, or address regulatory requirements, choose any AWS Region that is geographically close to you.

• Block all public access is checked by default. You may choose to customize it according to your company policy.

• Disable object lock, then select Create bucket.

Create a new IAM Policy

Important: At this point, you can choose to grant the user full access to your S3 buckets (by attaching the appropriate AWS managed policy) or create a new policy that applies only to the Check Point SASE bucket. If you choose the first option, you may skip this section.

1. Open the AWS Identity and Access Management (IAM) dashboard.
2. Go to the Policies tab and select Create policy.
3. Paste the following snippet as a JSON file. Replace test with the bucket name, then select Review policy.
   

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::test/*"
        }
    ]
}

{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow" ,
"Action" : [
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource" : ["${aws_s3_bucket.pm81-logs.arn}"]
},
{
"Effect" : "Allow" ,
"Action" : [
"s3:PutObject" ,
"s3:GetObject" ,
"s3:DeleteObject" ],
"Resource" : ["${aws_s3_bucket.pm81-logs.arn}/*" ]
}
]}

4. Fill in the following information, and then select Create policy.

• Name: Enter a name of your choice.
• Description (optional): Let other users in your account know what this policy aims for.

Create an AWS user

1. Open the AWS Identity and Access Management (IAM ) dashboard.
2. Go to the Users tab and select Add user.
   • Username: Enter a name of your choice. And select next.
3. Select Attach existing policies directly and choose the policy you created earlier (if you skipped the previous section, select the S3 full access AWS managed policy). Select Next.

Create an AWS access key

1. Open the AWS Identity and Access Management (IAM ) dashboard.
2. Navigate to the Users tab and select the user you have created.
3. Navigate to the Security credentials tab
4. Scroll down to Access keys and select Create access key 
5. Choose Application running outside AWS and click next
6. Choose Create access key (you can add Description tag value if you like)
7. Copy the Secret access key and the Access key 

Connect the S3 bucket to Check Point SASE

1. Log in to your Check Point SASE Management Platform, and navigate to Settings/Integrations, and select Add at the Amazon S3 row.
   
2. Fill in according to the values copied in the previous steps (the primary key will be used as your workspace key)
   
   • Access key ID = Access key (copied from AWS)  
   • Secret access key = Secret access key (copied from AWS)
   • Bucket = Your S3 Bucket Identifier (for example- if your bucket name is "arn:aws:s3:::tests3bucket", you will only need to input "tests3bucket")
   • Bucket region = The region you chose in the first step
3. Select Validate.

Recommendations

• Ensure that the IAM user has the necessary permissions to access the S3 bucket.
• Regularly review and update your S3 bucket settings to align with your organization's security policies.
• When setting up the integration, double-check the provided AWS credentials to avoid connectivity issues

Troubleshooting

Support Contacts

If you have any difficulties or questions, don't hesitate to contact Check Point SASE's support team. We offer 24/7 chat support on our website at sase.checkpoint.com, or you can email us at sase-support@checkpoint.com. We're here to assist you and ensure your VPN tunnel setup is a success.