Configuring file shadowing with AWS

When configuring file shadowing with AWS, you will need to create an S3 bucket and bucket policy. You must also create an IAM user policy and an IAM user to grant access permissions to the bucket and the shadow copies within it.

Bucket policy and TLS

A bucket policy allows or denies requests based on various elements, including the requester, S3 actions, resources, and aspects or conditions of the request—for example, the IP address used to make the request.

When configuring your policy, you should enable the bucket to:

• accept PutObject and GetObject requests, and
• only accept requests using TLS.

FortiDLP requires HTTPS (TLS) to prevent potential attackers from eavesdropping on or manipulating network traffic using person-in-the-middle or similar attacks. AWS supports HTTP by default, but you should allow only encrypted connections over HTTPS by using the aws:SecureTransport condition on your bucket policy.

The following instructions describe the tasks required to configure file shadowing with AWS.

How to configure file shadowing with AWS

1. Log in to the AWS Console.
2. Create your storage bucket:
   1. Go to Services > Storage > S3.
   2. Click Create bucket.
   3. In the Bucket name field, type the bucket name.
      
   4. In the AWS Region menu, select the bucket region. We recommend choosing the region your company is located in.
   5. Leave the ACLs disabled radio button and the Block all public access checkbox selected.
   6. In the Encryption type section, leave the Server-side encryption with Amazon S3 managed keys (SSE-S3) radio button selected.
   7. In the Bucket key section, leave the Enable radio button selected.
   8. Click Create bucket.
3. Create an IAM user policy:
   1. Go to Services > Security, Identity, & Compliance > IAM.
   2. In the left-hand panel, click Policies.
   3. Click Create Policy.
   4. Click the JSON tab.
   5. Paste the following JSON text, adding your storage bucket ARN. To retrieve this, go to Services > S3 > Buckets > your storage bucket (from step 2c) > Properties.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "FortiDLPBucketPolicy",
               "Effect": "Allow",
               "Action": [
                   "s3:PutObject",
                   "s3:GetObject"
               ],
               "Resource": "ARN FROM S3 BUCKET PROPERTIES PAGE/*"
           }
       ]
   }
   

   6. Click Next.
   7. In the Name field, type a policy name.
   8. In the Description field, type a policy description.
   9. Click Create policy.
4. Create an IAM user:
   1. In the left-hand panel, click Users.
   2. Click Create user.
   3. In the User name field, type a username. For example, FortiDLPBucketUser. This name will be included in AWS CloudTrail logs.
   4. In the Select AWS access type section, select the Access key - Programmatic access radio button.
   5. Click Next.
   6. In the Set permissions section, click Attach policies directly.
   7. Select the checkbox of your IAM user policy (from step 3).
   8. Click Next.
   9. Click Create user.
5. Create a bucket policy:
   1. Go to Services > Storage > S3.
   2. Click your storage bucket.
   3. Click the Permissions tab.
   4. In the Bucket policy section, click Edit.
   5. In the entry box, paste the following JSON text, adding your IAM user ARN and storage bucket ARN. To retrieve the IAM user ARN, go to Services > IAM > Access Management > Users > your IAM user (from step 4) > Summary. The storage bucket ARN is the ARN used in step 3e.

   {
   	"Version": "2012-10-17",
   	"Id": "S3-Console-Auto-Gen-Policy-1643731743161",
   	"Statement": [
   		{
   			"Sid": "BucketPermissions",
   			"Principal": {
                               "AWS": [
                                    "ARN FROM IAM USER PAGE"
                               ]
                          },
   			"Effect": "Allow",
   			"Action": [
   				"s3:PutObject",
   				"s3:GetObject"
   			],
   			"Resource": "ARN FROM S3 BUCKET PROPERTIES PAGE/*"
   		},
   		{
   			"Sid": "TLSRequired",
   			"Principal": "*",
   			"Effect": "Deny",
   			"Action": [
   				"s3:*"
   			],
   			"Resource": [
   				"ARN FROM S3 BUCKET PROPERTIES PAGE",
   				"ARN FROM S3 BUCKET PROPERTIES PAGE/*"
   			],
   			"Condition": {
   				"Bool": {
   					"aws:SecureTransport": [
   						"false"
   					]
   				}
   			}
   		}
   	]
   }
   

   To optionally limit bucket access to certain IP addresses, refer to AWS' documentation here and here.

   6. Click Save changes.
      

The AWS Console will then display your Access key ID and Secret access key. Remember these values, as you will need them to complete the next task, Configuring file shadowing with FortiDLP.