Set up your AWS S3

Create S3 bucket with default settings.

Create an IAM role to access S3 bucket and provide cross account permission.

1. Select Trusted entity type as AWS account.

2. Provide Trellix AWS account number - 983703175993 in the Another AWS Account section.

3. Create IAM policy with the following JSON format.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "s3:ListBucket"
               ],
               "Resource": [
                   "arn:aws:s3:::customer-eaf-bucket"
               ]
           },
           {
               "Effect": "Allow",
               "Action": [
                   "s3:GetObject",
                   "s3:PutObject"
               ],
               "Resource": [
                   "arn:aws:s3:::customer-eaf-bucket/*"
               ]
           }
       ]
   }

   Note

   Replace "customer-eaf-bucket name" with your S3 bucket name.

4. Review and create a policy. Also, attach the policy created in step c and create a role.

5. Once the role is created, edit the trust relationship to replace with below content. Also. replace XXXXXXXXXXXX with the actual Trellix AWS account number.

   Note

   You can enable External ID within the AWS S3 IAM policy to include the list of tenants whose events can be sent to the S3 bucket. This allows only the listed tenant configurations and data is sent to the AWS S3 bucket. Also, make sure External ID is the tenant ID of the customer.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::XXXXXXXXXXXX:role/EAF_S3CrossAccountAccess"
               },
               "Action": "sts:AssumeRole",            
                "Condition": {                
                  "StringEquals": {                    
                    "sts:ExternalId": "315F3DC7-3DE1-4050-ABBA-381BFE83D4DC"                }
               }
           },
           {
               "Sid": "Statement1",
               "Effect": "Allow",
               "Principal": {
                   "Service": "s3.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           }
       ]
   }