Knowledge Base Community Release Notes Training Videos Request Demo

Configuring AWS for Cloud Connected

Overview

A Cloud Connected deployment of Panther means that your organization owns the Snowflake account and the AWS account in which Panther is deployed, and Panther performs deployment upgrades of the platform.

After your Panther deployment is complete, you can monitor your Panther-related AWS costs.

The instructions on this page are for setting up a new Cloud Connected deployment. If you would like to convert an existing Panther-hosted (SaaS) instance to a Cloud Connected deployment, do not follow these steps; instead, reach out to your Panther Support team to initiate the conversion.

How to prepare for your initial Cloud Connected deployment

Prerequisites

Step 1: Configure your AWS account for the Panther deployment

To set up a Cloud Connected deployment of Panther, follow the below steps:

  1. Create a new AWS account, if needed. (It is also possible to use an existing empty one.)

    • Your Panther instance cannot be deployed in an AWS account with existing resources.

  2. Create a custom Panther domain by following the Configuring a Custom Domain instructions, skipping the Configure Panther section.

    You will select an AWS region for your Panther deployment during this step. Choose the same AWS region your Snowflake account is in. This region cannot later be changed.

    • Save the outputted CertificateArn and CustomDomain, as you will need them in the next step.

  3. Provide the following information to your Panther support team:

    • The CertificateArn and CustomDomain you generated in the previous step

    • The AWS region in which you created your custom domain in the previous step

    • Your AWS account ID

    • The Email, Firstname, and Lastname for the initial Panther user

    • Your Snowflake version

  4. Deploy the "Deployment Role" CloudFormation template, using the values for the three template parameters (DeploymentRoleName, IdentityAccountId, and OpsAccountId) provided by Panther.

    • The stack must be created in the region you intend to deploy Panther.

    • This template is stored in S3. The following URL can be used directly when creating the stack:

      https://panther-public-cloudformation-templates.s3.us-west-2.amazonaws.com/panther-deployment-role/latest/template.yml

    • If you have not already been provided values for the template parameters, please contact your Panther support team before continuing. We recommend naming the stack PantherDeploymentRoleStack for consistency with its contents.

    • This template provisions an IAM role,PantherDeploymentRole, that Panther will assume to perform upgrades.

    • See the CloudFormation documentation for instructions on how to create a CloudFormation stack from a template either using the CloudFormation console or using the AWS CLI.

  5. Follow Panther's instructions to deploy the Pre-Deployment tools.

Step 2: Set up your Snowflake credentials in your AWS account

If you have not already set up your Snowflake credentials in AWS, please follow the steps below.

  1. Follow the instructions on Storing Snowflake Connected Credentials with a Cloud Connected Deployment to set up your Snowflake credentials in your AWS account.

  2. Inform your Panther support team that you have finished this process.

Step 3: Run the Readiness Checker tool in the AWS account

  1. Follow Panther's instructions for running the Readiness Checker tool.

  2. Inform your Panther support team of the results.

    • Panther will proceed with the deployment.

Step 4: Configure DNS records for your Panther deployment

Complete these steps after Panther has confirmed that your deployment is ready.

  1. In AWS Certificate Manager (ACM), create two separate, public wildcard certificates for *.yourcustomdomain.xyz that can be used for the following Panther endpoints:

    • api

      • The wildcard certificate for this endpoint must be created in us-east-1 as Edge-optimized. Custom domains cannot use certificates created in other regions.

    • logs

      • The wildcard certificate for this endpoint must be created in the same region as the Panther deployment.

    For additional information, please see the AWS documentation.

  2. In Route53, create a CNAME record with the value for the api and logs wildcard ACM certificates created in the previous step to validate each of the certificates.

  3. Locate the AWS-provided DNS name for the http-ingest-alb:

  4. Using the DNS name mentioned in the previous step, create an A record in Route53 using the following format: logs.yourcustomdomain.xyz.

  5. To validate that the logs endpoint is working as expected, run an nslookup against logs.yourcustomdomain.xyz or dig +short logs.yourcustomdomain.xyz.

    • Also ensure that the http-ingest-alb is using the logs wildcard ACM certificate created in Step 1.

  6. Provide the new api wildcard ACM certificate to Panther so that the api endpoint can be configured.

    • We do not recommend doing this manually.

  7. Once Panther has updated the deployment with the new ACM certificate, create an A record in Route53 that points to the Cloudfront distribution created automatically in the previous steps. The Cloudfront DNS entry will be provided by Panther.

  8. To validate that the API endpoint is working as expected, attempt PAT workflows using https://api.yourcustomdomain.xyz/public/graphql for --api-host.

Step 5: Request API Gateway and Lambda quota increases

PreviousConfiguring Snowflake for Cloud ConnectedNextPre-Deployment Tools

Last updated