How To Scan Amazon S3 Buckets

This section covers the following topics:

• Overview
• Licensing
• Requirements
  • Encryption
• Get AWS User Security Credentials
• Set Up and Scan an Amazon S3 Target
  • Add Amazon S3 as a Target
  • Scan an Amazon S3 Target
• Edit Amazon S3 Target Path

Overview

When probing an Amazon S3 Buckets Target, ER Cloud lists all buckets (if any) in the principal account that the IAM user (whose credentials are used for the scan) belongs to. However, scans can only be completed successfully for buckets that the IAM user has (at minimum) read access to.

Buckets in other principal accounts (cross principal accounts) that the IAM user has (at minimum) read access to can also be probed and scanned. To scan Amazon S3 Buckets in cross principal accounts, add the bucket manually as a new location under the existing Amazon S3 Target.

To add Amazon S3 Buckets as Targets:

1. Check the Requirements.
2. Get AWS User Security Credentials.
3. Set Up and Scan an Amazon S3 Target.
   1. Add Amazon S3 as a Target.
   2. Scan an Amazon S3 Target.

To scan specific objects in the Target bucket, refer to Edit Amazon S3 Target Path below.

Licensing

For Sitewide Licenses, all scanned Amazon S3 Targets consume data from the Sitewide License data allowance limit.

For Non-Sitewide Licenses, Amazon S3 Targets require Server & DB Licenses, and consume data from the Server & DB License data allowance limit.

See Target Licenses for more information.

Requirements

Encryption

ER Cloud supports Amazon S3 Buckets that use the following encryption methods:

1. Server-side encryption with Amazon S3-managed encryption keys (SSE-S3)
2. Server-side encryption with AWS KMS-managed keys (SSE-KMS)

3. Server-side encryption with customer-provided encryption keys (SSE-C)

   ER Cloud supports only one encryption key value for scanning Amazon S3 Buckets protected by SSE-C method. Scan the Target using different credential sets if multiple encryption key values are required to access all objects within a bucket.

Get AWS User Security Credentials

1. Log in to the AWS IAM console.
2. On the left of the page, click Users and select an IAM user with the following access permissions to the Amazon S3 Buckets that you want to scan:
   • ListAllMyBuckets
   • ListBucket
   • GetBucketLocation
   • GetObject
     
3. On the User page, click on the Security Credentials tab. The tab displays the user’s existing Access Keys.
4. Click Create Access Key. A dialog box appears, displaying a new set of User security credentials. This consists of an Access Key ID and a Secret Access Key.
5. Click Download Credentials to save the User security credentials in a secure location, or write it down in a safe place. You cannot access this set of credentials once the dialog box is closed.
   

Set Up and Scan an Amazon S3 Target

Add Amazon S3 as a Target

1. From the New Scan page, add Targets. Refer to the Add Targets section.
2. In the Select Target Type dialog box, select Amazon S3.

3. In the Amazon S3 Details section, fill in the following fields:
   

   Field	Description
   Label	Enter a descriptive label for the Amazon S3 Target. Example: UserA_Amazon_S3.
   New Credential Label	Enter a descriptive label for the credential set.
   Access Key ID	Enter the Access Key ID obtained in Get AWS User Security Credentials. Example: AKIAABCDEFGHIEXAMPLE.
   Secret Access Key	Enter the Secret Access Key obtained in Get AWS User Security Credentials. Example: aBcDeFGHiJKLM/A1NOPQR/wxYzdcbAEXAMPLEKEY.
   Private Key	Upload the file containing the customer-provided 256-bit encryption key. Only required for Amazon S3 Buckets that use the server-side encryption with customer-provided encryption keys (SSE-C) method for object encryption. Example: my_amazon_key.txt.
   Agent to act as a proxy host	Select a Proxy Agent host with direct Internet access.

   AWS
   Please check if your AWS administrator has a set of IAM access keys for your use. AWS advises against using AWS root credentials. Use IAM whenever possible. For more information, refer to AWS official documentation.
   Recommended Least Privilege User Approach

   To reduce the risk of data loss or privileged account abuse, the Target credentials provided for the intended Target should only be granted read-only access to the exact resources and data that require scanning. Never grant full user access privileges or unrestricted data access to any application if it is not required.

4. Click Test. If ER Cloud can connect to the Target, the button changes to a Commit button.
5. Click Commit to add the Target.
6. Back in the New Scan page, locate the newly added Amazon S3 Target and click on the arrow next to it to display a list of available buckets for the Amazon S3 user.

Scan an Amazon S3 Target

Scan Buckets in a Single Principal Account

1. In Scans > New Scan page, locate the newly added/existing Amazon S3 Target and select the Target location(s) to scan.

   ER Cloud lists all buckets (if any) in the principal account that the IAM user (whose credentials are used for the scan) belongs to. However, scans can only be completed successfully for buckets that the IAM user has (at minimum) read access to. For more information, refer to Scanning Amazon S3 Buckets in a Single and Cross Principal Accounts.

   • If "All data on new target AWSS3:<Amazon_Target_Label>" or "Amazon S3 : All buckets on new target AWSS3:<Amazon_Target_Label>" is selected, ER Cloud scans all objects contained in all buckets available for the IAM user account.
     

     For this setup, ER Cloud probes and retrieves the buckets under an IAM user account for each instance of a recurring scan. Any new bucket added after the scan was first scheduled is included in the following scan.

   • If only specific buckets are selected, ER Cloud scans only the objects contained in the selected buckets.
     

     For this setup, ER Cloud probes and retrieves only the objects in the selected buckets. Any new bucket added after the scan was first scheduled is not included in the following scan.
2. Click Next.
3. On the Select Data Types page, select the data type profiles to be included in your scan (refer to the Use Data Type Profile section) and click Next.

4. On the Set Schedule page, configure the parameters for your scan. For more information, refer to Set Schedule in the Start a Scan section.

5. Click Next.
6. On the Confirm Details page, review the details of the scan schedule, and click Start Scan to start the scan. Otherwise, click Back to modify the scan schedule settings.

Scan Buckets in Other Principal Accounts

1. In Scans > New Scan page, locate the newly added/existing Amazon S3 Target.
2. Click Add New Location.
3. In the Path field, enter the name of the bucket in the other principal account.
4. In the Credentials Details section, fill in the fields using the credentials of the IAM user. Refer to step 3 of the Add Amazon S3 as a Target section.

5. Click Test and then Commit to save the path to the Target location.

   For this setup, ER Cloud probes and retrieves only the objects in the manually added bucket. Any new bucket added after the scan was first scheduled is not included in the following scan.

Edit Amazon S3 Target Path

To scan a specific object in the Amazon S3 Bucket:

1. Add Amazon S3 as a Target.
2. In the Select Locations section, select your Amazon S3 Bucket Target location and click Edit.

3. In the Edit Amazon S3 Bucket Location dialog, enter the Path to scan. Use the following syntax:

   Path	Syntax
   Whole Bucket	<BucketName>
   Specific folder in Bucket	<BucketName/folder_name>
   Specific file in Bucket	<BucketName[/folder_name]/filename.txt>

4. Click Test and then Commit to save the path to the Target location.