{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"2"},"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"1b259e0962eeb24797259fbaf89d7a2c"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"e14e6dfd-a63f-425a-9a52-8794e141aeca"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Logs generated by most AWS services (Cloudtrail, VPC Flows, Elastic Load Balancer, etc.) are exportable to a blob object in S3. Many other 3rd party services have also adopted this paradigm so it has become a common pattern used by many different technologies. Devo Professional Services and Technical Acceleration teams have a base-collector code that will leverage this S3 paradigm to collect logs and can be customized for different customer's different technology logs that may be stored into S3.","type":"text"}]},{"type":"paragraph","content":[{"text":"This documentation will go through setting up your AWS infrastructure for our collector integration to work out of the box:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Sending data to S3 (this guide uses Cloudtrail as a data source service)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Setting up S3 event notifications to SQS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enabling SQS and S3 access using a cross-account IAM role","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Gathering information to be provided to Devo for collector setup","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"General architecture diagram","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1295,"id":"ba053d9b-8a07-420c-b8cc-e0b3abf88191","collection":"contentId-313859967","type":"file","height":546}}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Requirements","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access to S3, SQS, IAM, and CloudTrail services","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Permissions to send data to S3","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Knowledge of log format/technology type being stored into S3","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Creating an S3 bucket and setting up a data feed (CloudTrail example)","type":"text"}]},{"type":"paragraph","content":[{"text":"The following will be set up during this section:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"S3 bucket for data storage","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"CloudTrail trail for data logging into an S3 bucket","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create an S3 bucket","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"5fbc764f-98bc-40c6-b7e6-0fc658ad9c49"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"6a85f3cc-b6a9-4f80-a0ce-ced4a6958436"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"c942ee77-ce6e-49ca-9195-5d6ad83d349c"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"2044642f-e08f-4f25-8bb4-aa53b4b19b34"}},{"type":"paragraph","content":[{"text":"Navigate to AWS Management Console and select S3.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1457,"id":"fa846227-2642-4fe1-aa26-a916eb5f3663","collection":"contentId-313859967","type":"file","height":605}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"53ae5151-5d9f-4735-a8bb-c0fb68d659ee"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"ee859a15-cca3-4e6a-84d9-c36d3e129477"}},{"type":"paragraph","content":[{"text":"Create a new bucket that you wish for these logs or skip to the next step if using an existing bucket. Default S3 bucket permissions should be fine.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1561,"id":"19836783-07c5-46ca-b2e6-8bc8649fc0e6","collection":"contentId-313859967","type":"file","height":319}}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Set up a CloudTrail trail to log events into an S3 bucket","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"8cac5dd8-1e20-417a-aba6-9fcdfc474451"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"be683400-5029-4625-ad1d-3b4568675733"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"7a38aed6-0038-4421-bc34-c2af917be5e2"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"12317bc6-5e59-450b-8ab6-09613924950e"}},{"type":"paragraph","content":[{"text":"After the bucket has been created, we will need to set up a data feed into this S3 bucket via CloudTrail. Click","type":"text"},{"text":" CloudTrail","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1459,"id":"52d0467e-6206-4d9b-8e21-1e0f47ce71ba","collection":"contentId-313859967","type":"file","height":607}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"3b7e5767-6bfc-49c2-b753-347d97913c05"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"65a35fb8-0474-46e4-9e96-a81b38ceb0f2"}},{"type":"paragraph","content":[{"text":"Create a new trail following these steps:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"dbcdbbbf-9c66-4681-9036-c01806cd2f7f"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create trail","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1060,"id":"61c39dc0-8948-4e5d-b697-3343f34f8c36","collection":"contentId-313859967","type":"file","height":457}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"When setting up the trail on the screen, make sure to choose the S3 bucket you want CloudTrail to send data into accordingly. If you have an existing S3 bucket, choose that box and enter your S3 bucket name. Otherwise, create a new S3 bucket here.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":3,"colwidth":[494.0]},"content":[{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1206,"id":"046b3a87-e7ca-4789-b966-d8b49145ccb8","collection":"contentId-313859967","type":"file","height":1764}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"A prefix is optional but highly recommended for easier set up of S3 event notifications to different SQS queues.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"All other options on this page are optional, but default settings do work. Check with your infra team to figure out what they want to do.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"On the next page, you choose the log events you wish for CloudTrail to capture. At the very least, we recommend ","type":"text"},{"text":"Management events","type":"text","marks":[{"type":"strong"}]},{"text":" be enabled. ","type":"text"},{"text":"Data events","type":"text","marks":[{"type":"strong"}]},{"text":" and","type":"text"},{"text":" Insight events","type":"text","marks":[{"type":"strong"}]},{"text":" are additional charges so check with your team about this. Data events can generate ","type":"text"},{"text":"A LOT","type":"text","marks":[{"type":"underline"}]},{"text":" of data if your account has power users of S3. Please check with your AWS team to see if these are worthwhile to track.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1191,"id":"c3a8c28c-f235-4fea-9835-68e32ec28b40","collection":"contentId-313859967","type":"file","height":829}}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[232.0]},"content":[{"type":"paragraph","content":[{"text":"Finish up and create the trail.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[494.0]},"content":[{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1283,"id":"df400cec-d460-4e85-b300-bebe5f3fbed6","collection":"contentId-313859967","type":"file","height":1583}}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Creating an SQS queue and enabling S3 event notifications","type":"text"}]},{"type":"paragraph","content":[{"text":"SQS provides the following benefits from our perspective:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Built in retrying on the failure of processing a message","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Dead letter queueing (if enabled when setting up SQS queue)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows for downstream outage without loss of the state of processing","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allows for parallelization of workers in event of very high volume data","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Guaranteed at least once delivery (S3 and SQS guarantees)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ability to have multiple S3 buckets send events to the same SQS queue and even those in other accounts via S3 event notifications to SNS to SQS in the target account","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Optional - Using event otifications with SNS","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Sending S3 event notifications to SNS may be beneficial/required to some teams if they are using the bucket event notifications in multiple applications. This is fully supported as long as the original S3 event notification message gets passed through SNS transparently to SQS. You will not need to follow the steps to set up event notifications to a single SQS, but could follow the Amazon documentation here to setup the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"S3 event notifications → SNS","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/AmazonS3/latest/dev/ways-to-add-notification"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SNS → SQS","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/sns/latest/dg/sns-sqs-as-subscriber.html"}}]}]}]}]},{"type":"paragraph","content":[{"text":"A brief write-up of this architecture can be found in ","type":"text"},{"text":"this AWS blog","type":"text","marks":[{"type":"link","attrs":{"href":"https://aws.amazon.com/blogs/compute/fanout-s3-event-notifications-to-multiple-endpoints"}}]},{"text":". Note this will also help if you have buckets in different regions/accounts and would like one centralized technology queue for all of your logging.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create an SQS queue for a specific service events type (i.e. CloudTrail)","type":"text"}]},{"type":"paragraph","content":[{"text":"In this example, we will continue by setting up an SQS queue for our CloudTrail technology logs.","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"04e6acd1-0960-412d-980d-1d7cef52e8f4"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"24a1913a-48d7-4dd6-aec2-c15b2172bc67"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"897ca57b-f013-4f68-83e4-2107ac94e67d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"3d9e7df4-aee2-4aa1-bd4b-e1c78e387a91"}},{"type":"paragraph","content":[{"text":"Navigate to the SQS console.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"ec0ed23a-7903-4931-b5b9-a9ae3f75c88e"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"ce25c1ce-498b-4950-8849-3eec7495c08c"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create queue","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"b38c332a-48dd-42b3-9972-1cbe5b27a36e"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"31be6e9d-4441-4df0-b66e-8ded167242eb"}},{"type":"paragraph","content":[{"text":"Create a ","type":"text"},{"text":"Standard ","type":"text","marks":[{"type":"strong"}]},{"text":"queue, the default configuration is fine.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"f9cd3b3f-e141-4325-8e8d-094b9240fd49"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"a938c515-7da3-4f9c-b01a-3f64e8c16182"}},{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Access policy","type":"text","marks":[{"type":"strong"}]},{"text":" section, select ","type":"text"},{"text":"Advanced","type":"text","marks":[{"type":"strong"}]},{"text":" and copy and paste the following policy replacing where ","type":"text"},{"text":"{{ }}","type":"text","marks":[{"type":"em"}]},{"text":" occurs.","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Id\": \"example-ID\",\n \"Statement\": [\n {\n \"Sid\": \"example-statement-ID\",\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"Service\": \"s3.amazonaws.com\"\n },\n \"Action\": [\n \"SQS:SendMessage\"\n ],\n \"Resource\": \"arn:aws:sqs:{{SQS queue region}}:{{Account ID #}}:{{Queue name you are currently creating}}\",\n \"Condition\": {\n \"ArnLike\": { \"aws:SourceArn\": \"arn:aws:s3:*:*:{{Bucket name with data here}}\" },\n \"StringEquals\": { \"aws:SourceAccount\": \"{{Account ID # of the bucket}}\" }\n }\n }\n ]\n}","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"An example resource ARN should look like this: ","type":"text"},{"text":"arn:aws:sqs:us-east-1:0123456789:devo-example-sqs-queue","type":"text","marks":[{"type":"code"}]}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"89ea2bd2-b690-4b68-8b54-fc4715709206"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"a57637e8-e1ca-408e-ac28-8c69d4b3e449"}},{"type":"paragraph","content":[{"text":"The rest of the default configuration is fine, but you can set up a dead letter queue and server-side encryption, which is transparent to our side.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"4aec1aaa-497c-4c81-9eb6-5ad03c27018b"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"815b3fdd-bc72-4310-abb8-bd4c382885b6"}},{"type":"paragraph","content":[{"text":"Create the queue.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"fec7b936-cd17-4cf1-aa90-56a354d22559"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"c92d94a0-ff34-4cbd-8787-3b270b395ff9"}},{"type":"paragraph","content":[{"text":"Copy the URL of your newly created queue and save it, as you will need to provide Devo with this.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":977,"id":"291d114d-cdd4-40fa-86cf-f1642e60eca1","collection":"contentId-313859967","type":"file","height":455}}]},{"type":"paragraph"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Setup S3 event notifications","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"7bce79a3-bf93-4b99-addc-64ca6186c4ec"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"506b632a-c5d1-4964-9d76-f99f88b70230"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"225b4f1c-d718-4e55-b9e0-e5cf35f42971"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"a3c359e8-a43e-48a4-a27e-ee6ec060df89"}},{"type":"paragraph","content":[{"text":"Navigate back to your S3 bucket with data in it.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"3ad6fe41-0eb0-443f-9296-5ad4bb71d7cd"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"0f3a3ebb-fe9e-43d9-93fe-87e0c7bd544f"}},{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Properties ","type":"text","marks":[{"type":"strong"}]},{"text":"tab of the bucket.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1538,"id":"40d3df64-e6ab-4532-863c-3bb1cd48faf9","collection":"contentId-313859967","type":"file","height":851}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"81f772a7-22ef-4513-bb78-2d51535d870d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"cb7e99f9-ea68-46f0-b3f4-85d812e26ee5"}},{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Events","type":"text","marks":[{"type":"strong"}]},{"text":" box under ","type":"text"},{"text":"Advanced settings","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"dcd6c6d7-104f-4cf5-8a09-429d45dedbdd"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"b3537cd9-045c-472d-9be8-975d855a3ef9"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create event notification","type":"text","marks":[{"type":"strong"}]}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":1531,"id":"3d238d44-5db4-4cb1-b89e-ea5202d7cd50","collection":"contentId-313859967","type":"file","height":89}}]},{"type":"mediaSingle","attrs":{"layout":"center","width":30.0},"content":[{"type":"media","attrs":{"width":415,"id":"d4c847ce-a036-45d5-aaac-c4e1f727acdb","collection":"contentId-313859967","type":"file","height":236}}]},{"type":"mediaSingle","attrs":{"layout":"center","width":30.0},"content":[{"type":"media","attrs":{"width":410,"id":"5958018c-fec8-4df6-9fb6-7d6ccc6dc6c2","collection":"contentId-313859967","type":"file","height":887}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"bb608313-9e1b-44c2-b714-9bed39170d39"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"c36b2984-1e3d-4812-9b3c-ea3b18497290"}},{"type":"paragraph","content":[{"text":"Setup the event notifications similar to the following:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The event notification name can follow whatever naming convention you need.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Type of event: ","type":"text"},{"text":"All object create events","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you put in a ","type":"text"},{"text":"Prefix ","type":"text","marks":[{"type":"strong"}]},{"text":"for your technology types, set the same here","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The suffix should be ","type":"text"},{"text":".json.gz","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set ","type":"text"},{"text":"SQS Queue","type":"text","marks":[{"type":"strong"}]},{"text":" as notifications destination","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the SQS queue name of the queue you created earlier.","type":"text"}]}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"6e25e678-b477-4e89-8c59-23c456201fdd"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"c3916bd6-c9f1-4cd2-9914-ac800bc4cdbe"}},{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Save ","type":"text","marks":[{"type":"strong"}]},{"text":"button after configuring this.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"f950630e-1e64-4d42-b0a2-2776c62e6fc8"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"253721a5-df39-4ad3-8b1e-a1d9eb511421"}},{"type":"paragraph","content":[{"text":"CloudTrail trail logs should now be generating corresponding messages in the queue if all was properly configured.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling SQS and S3 access using a cross-account IAM role","type":"text"}]},{"type":"paragraph","content":[{"text":"For allowing the Devo collector to pull in data from your AWS environment, we will need an IAM cross-account role in your account. You will have to provide this role’s ARN to Devo.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create an IAM policy","type":"text"}]},{"type":"paragraph","content":[{"text":"This IAM policy will:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Allow the role to read messages off the SQS queue and acknowledge (delete) them off the queue after successfully processing the messages","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Retrieve the S3 object referenced in the SQS message so that Devo can read and process the message into the system","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Provide limited access only to specified resources (minimal permissions)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Follow the next steps to create the IAM policy:","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"42f9835f-3d47-4a98-9392-6a09747abbca"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"2903e3f9-1817-4fb2-b23d-663ec4d2c0f4"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"12afe880-be18-4ea3-a8d0-b423cef36d8b"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"3137cacc-c5da-4e22-bf49-67402862c576"}},{"type":"paragraph","content":[{"text":"Navigate to the ","type":"text"},{"text":"IAM ","type":"text","marks":[{"type":"strong"}]},{"text":"console.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":294,"id":"6b422707-cc9c-49d4-a1ec-12d0cbe84bb9","collection":"contentId-313859967","type":"file","height":465}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"14480f75-a056-4bd6-bc69-d8df7bbdb3a5"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"aec27348-a9be-4947-adca-0c5e82e28e86"}},{"type":"paragraph","content":[{"text":"Go to the ","type":"text"},{"text":"Policies","type":"text","marks":[{"type":"strong"}]},{"text":" section.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":284,"id":"9b594fd5-2b2d-43f1-85f6-99d819f58af7","collection":"contentId-313859967","type":"file","height":686}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"7457ddcb-f3f2-4257-bbf7-e309747ac2d3"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"1ae686cc-919b-4b5a-84db-09da6d0b55a6"}},{"type":"paragraph","content":[{"text":"Create a policy.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"e9fd6ab7-016b-4d1e-b39b-4969b75e8eea"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"7d2c7efc-329d-4765-8e30-113e0b9483b9"}},{"type":"paragraph","content":[{"text":"Choose the JSON method and enter in the following policy while replacing the items within ","type":"text"},{"text":"{{}}","type":"text","marks":[{"type":"em"}]},{"text":" (ARN’s for the S3 bucket -optionally including configured prefix- and the SQS queue setup are in the previous steps of this guide).","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Sid\": \"VisualEditor0\",\n \"Effect\": \"Allow\",\n \"Action\": [\n \"s3:GetObject\",\n \"sqs:DeleteMessage\",\n \"sqs:GetQueueAttributes\",\n \"sqs:ChangeMessageVisibility\",\n \"sqs:ReceiveMessage\",\n \"sqs:GetQueueUrl\"\n ],\n \"Resource\": [\n \"arn:aws:sqs:<>:<>:<>\",\n \"arn:aws:s3:::</<>/*\"\n ]\n }\n ]\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"You can keep adding more resources if you have multiple SQS queues and S3 buckets that you would like Devo to pull and read from.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If KMS encryption is ","type":"text"},{"text":"active","type":"text","marks":[{"type":"underline"}]},{"text":" for the S3 bucket, the respective KMS key ","type":"text"},{"text":"must be included","type":"text","marks":[{"type":"underline"}]},{"text":" as a resource within the IAM policy. Otherwise, the Devo collector will fail to pull events due to a permission error: \"An error occurred (AccessDenied) when calling the GetObject operation: Access Denied\".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"/* trailing","type":"text","marks":[{"type":"code"}]},{"text":" in the S3 ARN denotes access to objects in the S3 Bucket. If missing, calls to the S3 API will result in a permission error and objects cannot be accessed by the collector.","type":"text"}]}]}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"09a72cdc-cd37-49f9-8d6a-f0f84c23aad9"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"6e851550-a15c-4535-b6c3-5810a3dc754f"}},{"type":"paragraph","content":[{"text":"Give the policy a name with the naming convention that your account uses as necessary and an optional description.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"d3787223-3b35-4914-b5de-b3f8b295b798"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"dd5e3e30-3568-4eea-b527-70822f29e07a"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create ","type":"text","marks":[{"type":"strong"}]},{"text":"and note down the policy name you've created for the access method needed for the Devo collector's proper functioning.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Create a cross-account role","type":"text"}]},{"type":"paragraph","content":[{"text":"Cross-account roles let roles/users from other AWS accounts (in this case, the Devo collector server AWS Account) access to assume a role in your account. This sidesteps the need to exchange permanent credentials, as credentials are still stored separately in their respective accounts, and AWS themselves authenticates the identities. For more information, ","type":"text"},{"text":"check this document","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Follow these steps to create the cross-account role:","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"5eadfcdd-5f2f-4dbd-819e-ee211bdb4184"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/steps.png"}}],"title":"UI Steps"}},"localId":"db19a29b-3e9d-483e-8b92-9f5b38c28169"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"e1e1d5a0-d3eb-4e35-8490-faa319281478"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"6d5e2836-e410-4b18-a82f-ea53d150fab5"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Roles ","type":"text","marks":[{"type":"strong"}]},{"text":"in the IAM console, then select ","type":"text"},{"text":"Create role","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1315,"id":"5f3bacb4-1997-48e7-96a2-48dab4fd2eca","collection":"contentId-313859967","type":"file","height":635}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"3e4e012b-e217-411f-a3b7-6937c14eda56"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"26c14c17-bf38-476a-bff9-1d719cf191d7"}},{"type":"paragraph","content":[{"text":"Create a role with the ","type":"text"},{"text":"Another AWS account","type":"text","marks":[{"type":"strong"}]},{"text":" scope and use","type":"text"},{"text":" Account ID:837131528613","type":"text","marks":[{"type":"strong"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"c868b971-7a56-4568-bad4-f959c15e5751"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"060a0dd4-b71c-4ad2-be84-59eb509505a9"}},{"type":"paragraph","content":[{"text":"Attach the policy you created in the previous steps (i.e.: ","type":"text"},{"text":"devo-xaccount-cs-policy","type":"text","marks":[{"type":"em"}]},{"text":")","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1033,"id":"4d21ac82-4f67-47f4-b243-bf6d81c11a4b","collection":"contentId-313859967","type":"file","height":436}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"8d1b779c-ddbc-481c-bdbf-91b392356c4f"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"1d2251f8-06b3-4918-8799-c05f10784dfb"}},{"type":"paragraph","content":[{"text":"Give this role a name (you will provide this to Devo)","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1084,"id":"cc37cf55-adff-4d2a-9cc4-cfc1f781fb58","collection":"contentId-313859967","type":"file","height":620}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"ad805383-5832-4ea9-8506-f1571c88aac1"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"0270a7c3-5c9f-457c-8c96-a6697751055d"}},{"type":"paragraph","content":[{"text":"Go into the newly created role and click ","type":"text"},{"text":"Trust relationships","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Edit trust relationship","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":1406,"id":"ec49fd1d-c477-49f5-a1bb-f38bef781913","collection":"contentId-313859967","type":"file","height":652}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"dddf1c25-ad07-492b-8260-264477911454"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"8defb368-e017-49d0-becb-57ce200ec20f"}},{"type":"paragraph","content":[{"text":"Change the existing policy document to the following, which will only allow for our collector server role to access the policy.","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"AWS\": \"arn:aws:iam::837131528613:role/devo-xaccount-cs-role\"\n },\n \"Action\": \"sts:AssumeRole\",\n \"Condition\": {\"StringEquals\": {\"sts:ExternalId\": {{YOUR_CONFIGURED_EXTERNALID}}\n }\n ]\n}","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"7b7113d4-7292-47d5-912d-e34a45dd2655"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"UI Step"}},"localId":"bf54cb75-823f-40fa-ad61-7e8c77bce6a8"}},{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Update Trust Policy","type":"text","marks":[{"type":"strong"}]},{"text":" to finish.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Information to be provided to Devo","type":"text"}]},{"type":"paragraph","content":[{"text":"At the end of this configuration process, the following tidbits of information will have to be provided to Devo for the collector setup in order to complete the integration:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Technology type that we will be consuming, or log format (in case the collector is pulling data from an AWS service - i.e: this guide is using CloudTrail as an example-, just the service name must be provided)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"SQS Queue URL","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Cross-account role ARN (i.e.: ","type":"text"},{"text":"arn:aws:iam:::role/devo-xs-collector-role","type":"text","marks":[{"type":"em"}]},{"text":") and optionally, ","type":"text"},{"text":"ExternalID","type":"text","marks":[{"type":"em"}]},{"text":" (if used in cross account role trust policy)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once this information is provided and Devo confirms there is already a parser available (or finishes creating it) for processing your technology logs, a new Devo collector will be deployed to the Devo’s collector server cluster and it will start consuming data off of the SQS queue and S3 bucket.","type":"text"}]}],"version":1}

Browser not supported