Skip to main content

API - AWS S3

Kamal Bennoune
  • Updated
VendorAWS S3 Bucket
Collection MethodAPI
Query Syntax: event.providerGenericS3
Billable Sources Calculation1 Source Per Integration.


To create the integration between Huntress and your AWS S3 Bucket(s), follow these steps:

  1. From the Huntress Dashboard > SIEM > Source Management > Source Catalog tab > AWS S3 > Add
     
  2. Select the green "+Add" button in the top right
     

  3. Select an Organization > Enter a Name for the AWS S3 Source > Add a Description (Optional) > Save


    --
     


     

  4. Download the CloudFormation template file by right-clicking the link and selecting "Save Link As..."
     
  5. Select the link, "navigate to the CloudFormation Stacks create page" to open a new tab within your AWS console. Sign in as an account owner.
     
  6. Click "Create stack" to Create a CloudFormation stack
     
  7. Upload the template file downloaded in step 4 > Click Next


     
  8. Provide a stack name and the S3BucketName of the existing S3 bucket to monitor > Click Next


     
  9. No changes are necessary for Configure stack options > Click Next
     
  10. Select Submit in the Review and Complete page
     
  11. After the stack is created, go to the Outputs tab and copy the JSON in the Value column of the BucketPolicyStatements row
     
    1. Go to S3 > Your bucket > Permissions > Bucket policy
    2. If there is already a bucket policy, paste the Huntress statements into that policy’s existing "Statement" array

    3. If there is no bucket policy yet, create one by clicking the Add new statement button. But, be mindful that the Output you copied already includes "Statement" and you do not want to end up nesting "Statement" inside "Statement":

      {
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "Statement1",
			"Principal": {},
			"Effect": "Allow",
			"Action": [],
			"Resource": []
		}
	]
}

       

  12. If the bucket is KMS-encrypted, you will also need to copy the JSON in the Value column of the KmsKeyPolicyStatement row
     
    1. Open the AWS KMS console > Find your key > Paste the Huntress statements into the key policy's Statement array
       
  13. Configure S3 event notifications on your existing bucket to send s3:ObjectCreated:* events to the SNS topic ARN shown in the Outputs tab
     
  14. Within 10-20 minutes, logs should begin showing in the Huntress SIEM

 

Related articles