CloudWatch Logs Source

CloudFormation or Terraform File

Use Panther's provided CloudFormation or Terraform templates to create an IAM role:

1. On the Create IAM Role page, on the CloudFormation or Terraform File tile, click Continue.

2. On the CloudFormation or Terraform Template File page, depending on which Infrastructure as Code (IaC) provider you'd like to use, select either CloudFormation Template or Terraform Template.

3. Click Download Template.

   • You can also find the Terraform template at this GitHub link.

4. In your CLI, run the command(s) in the Workflow section.

5. After deploying the template in your IaC pipeline, enter values in the fields:

   • (Not applicable if setting up an S3 Source) Bucket name – Required: Enter the outputted S3 bucket name.

   • Role ARN – Required: Enter the outputted IAM role ARN.

6. Click Setup.

I want to set everything up on my own

Create the IAM role manually, then enter the role ARN in Panther. When you set up the IAM role manually, you must also follow the "Manual IAM role creation: Additional steps" instructions below to configure your S3 buckets to send notifications when new data arrives.

1. On the Create IAM Role page, click I want to set up everything on my own.

2. Create an IAM role, either manually or through your own automation.

   • The IAM policy, which will be attached to the role, must include the statements defined below:

     Copy

     {
         "Version": "2012-10-17",    
         "Statement": [
             {
                 "Action": "s3:GetBucketLocation",
                 "Resource": "arn:aws:s3:::<bucket-name>",
                 "Effect": "Allow"
             },
             {
                 "Action": "s3:GetObject",
                 "Resource": "arn:aws:s3:::<bucket-name>/<input-file-path>",
                 "Effect": "Allow"
             }
         ]
     }

   • If your S3 bucket is configured with server-side encryption using AWS KMS, you must include an additional statement granting the Panther API access to the corresponding KMS key. In this case, the policy will look something like this:

     Copy

     {
         "Version": "2012-10-17",    
         "Statement": [
             {
                 "Action": "s3:GetBucketLocation",
                 "Resource": "arn:aws:s3:::<bucket-name>",
                 "Effect": "Allow"
             },
             {
                 "Action": "s3:GetObject",
                 "Resource": "arn:aws:s3:::<bucket-name>/<input-file-path>",
                 "Effect": "Allow"
             },
             {
                 "Action": ["kms:Decrypt", "kms:DescribeKey"],
                 "Resource": "arn:aws:kms:<region>:<your-account-id>:key/<kms-key-id>",
                 "Effect": "Allow"
             }
         ]
     }

   • In addition to the above, if you want to view the contents of your S3 bucket in the Panther Console (such as to utilize the inferring custom schemas from historical data feature), you will need to add the s3:ListBucket action: \

     Copy

     {   
          "Version": "2012-10-17",    
         "Statement": [
             {
                 "Action": [
                     "s3:GetBucketLocation",
                     "s3:ListBucket"
                 ],
                 "Resource": "arn:aws:s3:::<bucket-name>",
                 "Effect": "Allow"
             },
             {
                 "Action": "s3:GetObject",
                 "Resource": "arn:aws:s3:::<bucket-name>/<input-file-path>",
                 "Effect": "Allow"
             }
         ]
     }

3. Add a trust policy to your role with the following AssumeRolePolicyDocument statement so that Panther can assume this role:

   Copy

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": [
             "arn:<aws-partition>:iam::<panther-master-account-id>:root"
           ]
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "Bool": {
             "aws:SecureTransport": true
           }
         }
       }
     ]
   }

   • Populate <AWS-PARTITION> with the partition of the account running the Panther backend (e.g., aws). Note that we do not deploy to aws-cn or aws-us-gov.

   • Populate <PANTHER-MASTER-ACCOUNT-ID> with the 12-digit account ID where Panther is deployed. To get your AWS Account ID: Click the gear icon in the upper right side of the Panther Console to access Settings, then the AWS account ID is displayed at the bottom of the page.

4. In the Panther Console, enter values in the fields:

   • (Not applicable if setting up an S3 Source) Bucket name – Required: Enter the outputted S3 bucket name.

   • Role ARN – Required: Enter the outputted IAM role ARN.

5. Click Setup.

6. Proceed to the "Manual IAM role creation: Additional steps" section below.

How to modify an existing SNS topic

Follow the steps below if you wish to use an existing SNS topic for sending S3 bucket notifications. Note that the SNS topic must be in the same region as your S3 bucket.

Step 1: Enable KMS encryption for the SNS topic

1. Log in to the AWS console and navigate to KMS.

2. Select the KMS key you want to use for encryption.

3. Edit the policy to ensure it has the appropriate permissions to be used with the SNS topic and S3 bucket notifications.

   • Example policy:

     Copy

     {
         "Sid": "Allow access for Key User (SNS Service Principal)",
         "Effect": "Allow",
         "Principal": {
             "Service": "sns.amazonaws.com"
         },
         "Action": [
             "kms:GenerateDataKey*",
             "kms:Decrypt"
         ],
         "Resource": "<SNS-TOPIC-ARN>"
     },
     {
         "Sid": "Allow access for Key User (S3 Service Principal)",
         "Effect": "Allow",
         "Principal": {
             "Service": "s3.amazonaws.com"
         },
         "Action": [
             "kms:GenerateDataKey*",
             "kms:Decrypt"
         ],
         "Resource": "arn:aws:s3:::<bucket-name>"
     }

4. Click the Encryption tab under the SNS topic.

5. Click Enable, and specify the KMS key you want to use for encryption.

Step 2: Modify SNS topic Access Policy

Create a subscription between your SNS topic and Panther's log processing SQS queue.

1. Navigate to the SNS console and select the SNS topic currently receiving events.

   • Note the ARN of this SNS topic.

2. Click Edit and scroll down to the Access Policy card.

3. Add the following statement to the topic's Access Policy:

   Copy

   {
     "Sid": "CrossAccountSubscription",
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::<PANTHER-MASTER-ACCOUNT-ID>:root"
     },
     "Action": "sns:Subscribe",
     "Resource": "<SNS-TOPIC-ARN>"
   }

   • Populate <PANTHER-MASTER-ACCOUNT-ID> with the 12-digit account ID where Panther is deployed. This AWS account ID can be found in your Panther Console at the bottom of the page after navigating to Settings by clicking the gear icon.

   • Populate SNS-TOPIC-ARN with the ARN you noted previously in this documentation.

Step 3: Create SNS subscription to SQS

Create the subscription to the Panther Master account's SQS queue.

1. From the SNS console, click Subscriptions.

2. Click Create subscription.

3. Fill out the form:

   • Topic ARN: Select the SNS topic you would like to use.

   • Protocol: Select Amazon SQS.

   • Endpoint: arn:aws:sqs:<PantherRegion>:<MasterAccountId>:panther-input-data-notifications-queue

   • Enable raw message delivery: Do not check this box. Raw message delivery must be disabled.

4. Click Create subscription.