Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Manual Setup - AWS CloudShell

If you choose the Manual setup option, Scanner will walk you through a series of AWS CloudShell commands you can run to create resources in your AWS account. CloudShell is a browser-based terminal in the AWS Management Console. You can run CLI commands to set up your resources across different services.

You can follow the steps directly in the Scanner UI, or you can follow the AWS CloudShell guide independently on your own.

Log in to your AWS Management Console, open CloudShell and follow the instructions below to set up your resources.

1. Set shell variables

Replace the values below with the Scanner-provided values and the names of buckets in your account.

# These values will be provided by Scanner
REGION="<INSERT_VALUE_HERE>"
SCANNER_AWS_ACCOUNT_ID="<INSERT_VALUE_HERE>"
STS_EXTERNAL_ID="<INSERT_VALUE_HERE>"

# Insert your AWS account ID here
YOUR_AWS_ACCOUNT_ID="<INSERT_VALUE_HERE>"

# S3 buckets used as destinations for Collect Rules (Scanner will write raw logs into these).
# Leave empty if not using Collect Rules: S3_COLLECT_RULE_DESTINATION_BUCKETS=()
S3_COLLECT_RULE_DESTINATION_BUCKETS=("<BUCKET_1>" "<BUCKET_2>")

# S3 buckets used as the source of Index Rules (raw logs will be ingested from these).
# Include the bucket in both if it is also a Collect Rule destination.
# Leave empty if not using Index Rules: S3_INDEX_RULE_SOURCE_BUCKETS=()
S3_INDEX_RULE_SOURCE_BUCKETS=("<BUCKET_1>" "<BUCKET_2>")

# KMS key ARNs for Collect Rule destination buckets (only if using customer-managed KMS keys).
# Leave empty if not using KMS keys: S3_COLLECT_RULE_DESTINATION_BUCKETS_KMS_KEY_ARNS=()
S3_COLLECT_RULE_DESTINATION_BUCKETS_KMS_KEY_ARNS=()

# KMS key ARNs for Index Rule source buckets (only if using customer-managed KMS keys).
# Leave empty if not using KMS keys: S3_INDEX_RULE_SOURCE_BUCKETS_KMS_KEY_ARNS=()
S3_INDEX_RULE_SOURCE_BUCKETS_KMS_KEY_ARNS=()

# These values are derived from values above
S3_INDEX_FILES_BUCKET_NAME=scnr-index-files-$STS_EXTERNAL_ID

# These are default names for resources to be created
IAM_SCANNER_ROLE_NAME="scnr-ScannerRole"
IAM_SCANNER_ROLE_POLICY_NAME="scnr-ScannerRolePolicy"
EVENT_RULE_EXEC_ROLE_NAME="scnr-LogsBucketsEventRuleExecRole"
EVENT_RULE_NAME="scnr-LogsBucketsObjectCreatedRule"

2. Create S3 index files bucket

This bucket is where Scanner stores index files, keeping all log data within your AWS account.

Please ensure this bucket is used exclusively for Scanner indexing. Avoid adding any unrelated files to maintain optimal performance.

3. Create EventBridge IAM role

When new log files appear in your S3 buckets, S3 sends object-created events to Amazon EventBridge. An EventBridge rule forwards those events to Scanner's event bus. This IAM role allows EventBridge to put events onto Scanner's event bus.

4. Create EventBridge rule

This rule matches S3 object-created events only from your Index Rule source buckets (S3_INDEX_RULE_SOURCE_BUCKETS) and forwards them to Scanner's event bus.

EventBridge rules only receive events from S3 buckets in the same region as the rule. If your Index Rule source buckets are in multiple regions, create this role and rule in each region (re-run the commands in sections 3 and 4 with the appropriate region).

5. Enable EventBridge on S3 buckets

Enable Amazon EventBridge notifications on each Index Rule source bucket so that object-created events are sent to EventBridge. The rule you created will forward them to Scanner's event bus.

Enabling EventBridge on a bucket does not conflict with existing S3 event notification configurations (SNS, SQS, or Lambda). Both can operate simultaneously.

6. Create IAM Scanner Role

Scanner will assume this IAM role to perform actions in your AWS account, such as reading and writing log files.

Adding more S3 buckets

If you need to add more S3 buckets from an existing account after the initial setup, you need to do the following:

For Index Rule Source Buckets

If you need to add more S3 log files buckets from an existing account after the initial setup, you need to do the following:

  • Enable EventBridge on each new bucket (same as in step 5: put-bucket-notification-configuration with EventBridgeConfiguration: {}).

  • Update the EventBridge rule so it forwards events from the new bucket: re-run the put-rule command from step 4 with S3_INDEX_RULE_SOURCE_BUCKETS updated to include the new bucket name(s). The rule's event pattern filters by bucket name, so new buckets must be added to the pattern.

  • Update the Scanner IAM role policy:

    1. Go to AWS Console -> IAM -> <Scanner Role>

    2. Permissions -> <Scanner Role Policy> -> Edit

    3. For each bucket, add two rows under the Resource array containing the log files buckets: one for bucket_arn and one for bucket_arn/*.

For Collect Rule Destination Buckets

  • Update the Scanner IAM role policy:

    1. Go to AWS Console -> IAM -> <Scanner Role>

    2. Permissions -> <Scanner Role Policy> -> Edit

    3. In the Collect Rule Destination Buckets statement, add two rows under Resource: one for arn:aws:s3:::bucket_name and one for arn:aws:s3:::bucket_name/*.

    4. In the Collect Rule Destination Buckets (test files) statement, add one row under Resource: arn:aws:s3:::bucket_name/*ScannerTestFile.

PreviousTerraform
NextTroubleshooting AWS Errors

Last updated

Was this helpful?