`
* **MasterAccountId**: The 12 digit AWS Account ID where Panther is deployed
* **PantherRegion**: The region where Panther is deployed
* **SnsTopicName**`:` The name of the SNS topic receiving the notification, by default this is `panther-notifications-topic`
6. Click **Next**, **Next**, and then **Create Stack** to complete the process.
Note: This stack has one output named `SnsTopicArn`.
### Modify an existing SNS topic
If you opted to create a new SNS topic in the previous step, skip this step and proceed to the section below, "Configure Event Notifications on the bucket."
Follow the steps below if you wish to use an existing topic for sending bucket notifications. Note that the SNS topic must be in the same region as your S3 bucket.
#### Set up encryption
We recommend enabling KMS encryption for the SNS topic:
1. Log in to the AWS console and navigate to KMS.
2. Select the KMS key you want to use for encryption.
3. Edit the policy to ensure it has the [appropriate permissions](https://docs.aws.amazon.com/AmazonS3/latest/userguide/grant-destinations-permissions-to-s3.html#key-policy-sns-sqs) to be used with the SNS topic and S3 bucket notifications.
* Example policy:
{
"Sid": "Allow access for Key User (SNS Service Principal)",
"Effect": "Allow",
"Principal": {
"Service": "sns.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey*",
"kms:Decrypt"
],
"Resource": "<SNS-TOPIC-ARN>"
},
{
"Sid": "Allow access for Key User (S3 Service Principal)",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [
"kms:GenerateDataKey*",
"kms:Decrypt"
],
"Resource": "arn:aws:s3:::<bucket-name>"
}
4. Click the **Encryption** tab under the SNS topic.
5. Click **Enable**, and specify the KMS key you want to use for encryption.
#### Modify SNS Access Policy
Create a subscription between your SNS topic and Panther's log processing SQS queue.
1. Log into the AWS Console for the account where your S3 bucket exists
2. Navigate to the [SNS Console](https://us-west-2.console.aws.amazon.com/sns/v3/home#/topics) and select the SNS Topic currently receiving events
3. Note the ARN of this SNS topic
4. Click **Edit** and scroll down to the "Access Policy" card
5. Add the following statement to the topic's `Access Policy`:
```
{
"Sid": "CrossAccountSubscription",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam:::root"
},
"Action": "sns:Subscribe",
"Resource": ""
}
```
* Populate `` with the 12-digit account ID where Panther is deployed. This AWS account ID can be found in your Panther Console at the bottom of the page after navigating to **Settings** by clicking the **gear** icon**.**
* Populate `SNS-TOPIC-ARN` with the ARN you noted previously in this documentation.
### Create SNS Subscription
Create the subscription to the Panther Master account's SQS queue.
From the SNS Console, click **Create subscription**:
1. **Fill out the form:**
* **Protocol**: `Amazon SQS`
* **Endpoint**: `arn:aws:sqs:::panther-input-data-notifications-queue`
2. **Do not** check the box for the `Enable raw message delivery` setting; `raw message delivery` must be disabled.
3. Click **Create subscription**.
Note: If your subscription is in a "Pending" state and does not get confirmed immediately, you must finish setting up this log source in your Panther Console. Panther confirms the SNS subscription only if a Panther log source exists for the AWS account of the SNS topic.
### Configure Event Notifications on the bucket
With the SNS Topic created, the final step is to enable notifications from the S3 buckets.
1. Navigate to the AWS [S3 Console](https://s3.console.aws.amazon.com/s3/home), select the relevant bucket, and click the **Properties** tab.
2. Locate the Event Notifications card.
3. Click **+ Create event notification** and use the following settings:
* In the "General Configuration" section:
* **Name**: `PantherEventNotifications`
* **Suffix**: (optional) limits notifications to objects with keys that end in matching characters
* **Prefix**: (optional) limits notifications to objects with keys that start with matching characters
* In the "Event Types" card, check the box next to `All object create events`.
* In the "Destination" card:
* Under "Destination," select SNS Topic.
* For `SNS Topic,` select `panther-notifications-topic` from the drop-down menu.
4. Click **Save**.
5. Make sure to [Finish the Source Setup in Panther](#step-3-finish-the-source-setup).
Panther will now start processing new files arriving to your bucket.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.panther.com/~/changes/Dd8nx2iqd1Pp2OzWJaWk/data-onboarding/data-transports/aws/s3.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
