Please replace placeholders<.> with the actual values.
IAM User Policies
Following IAM user policies are required for S3 and SQS if using SQS (s3 via SQS) as a log collection method:
IAM User Permission for S3:
{
"Effect": "Allow",
"Action": ["s3:ListBucket","s3:GetObject"],
"Resource": ["arn:aws:s3:::<bucketname>", "arn:aws:s3:::<bucketname>/*"],
"Condition": {}
}
IAM User Permission for SQS:
{
“Action”: [
“sqs:GetQueueAttributes”,
“sqs:GetQueueUrl”,
“sqs:ReceiveMessage”,
“sqs:DeleteMessage”,
“sqs:ListQueues"
],
“Effect”: “Allow”,
“Resource”: “arn:aws:sqs:<region>:<accountID>:<SQSName>”
}
Following IAM user policy is required for CloudWatch logs if using CloudWatchLog as a log collection method:
IAM User Permission for CloudWatch:
{
"Effect": "Allow",
"Action": [
"logs:describeLogGroups",
"logs:describeLogStreams",
"logs:filterLogEvents",
"logs:getLogEvents"
],
"Resource": [
"arn:aws:logs:<region>:<accountID>:<log-group>:<specificLogGroupName>"
]
}
Following IAM user policy is required when S3 or/and SQS are encrypted.
If separate keys are used to encrypt S3 and SQS, add the below policy twice with the separate key resources. If the same key is used to encrypt S3 and SQS, add the below policy only once.
IAM User Permission for KMS:
{
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:<AWS_Region>:<AWS_account_ID>:key/<key_ID>"
}
KMS Key Policies
Following KMS key policy is required when SQS is encrypted
Replace <KEY_ARN> placeholder in the below policy with the actual key ARN used to encrypt the SQS.
KMS Key Permission for S3 to access encrypted SQS:
{
"Sid": "Allow s3 to encrypt findings",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "<KEY_ARN>"
}