Amazon S3 configuration example

Configure an Amazon S3 bucket, IAM credentials, and permissions for Cortex XSOAR 8 SaaS incident exports.

This example shows how to configure Amazon S3 external cloud storage for incident export in Cortex XSOAR 8 SaaS, covering the S3 bucket, IAM credentials, and required permissions. You can adapt these steps for other S3-compatible buckets.

For complete Amazon configuration instructions, see:

• Amazon Simple Storage Solution (Amazon S3)
• AWS Identity and Access Management (IAM)

Before you begin, ensure you have:

• An AWS account
• Access to the AWS Management Console
• Permission to create a stack and its resources in AWS CloudFormation

1

Configure an Amazon S3 bucket

1. Log in to the AWS Management Console and navigate to the S3 service.
2. Using the S3 console, create or configure a general purpose bucket.
3. Record the bucket name and region for later.

2

Create IAM access keys

1. Open the AWS Identity and Access Management (IAM)service.
2. Create a user. Cortex XSOAR uses this user to connect with the bucket you just created.
3. In the Security credentials tab, create an access key using the Third-party service use case. The secret key is automatically generated.
4. Record both keys for later.

3

Create an IAM role and permissions policy

1. In AWS Identity and Access Management (IAM), create a role and follow the wizard.
2. In Step 1, select AWS service as the trusted entity and S3 as the use case. Click Next.
3. In Step 2, select Permissions → Set permissions boundary - optional → Create role without a permissions boundary to create a role. Click Next.
4. Enter a role name and description. Then define a custom policy with the following JSON:

   {
      "Version": "2012-10-17",
      "Statement": 
      [ 
         { 
            "Effect": "Allow",         
            "Action": [
               "s3:PutObject",
               "s3:GetObject",
               "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::YourBucketName/*"
         },
         {
            "Effect": "Allow","Action": "s3:ListBuckets",
            "Resource": "arn:aws:s3:::YourBucketName"
         }
      ]}

   In the above JSON, replace YourBucketName with your actual bucket name in two places. This automatically associates the policy with the bucket via the Amazon Resource Name (ARN).

   Save the role and policy.

Next steps

Configure Configure access to external storage to export incidents to Amazon S3.