Skip to content

S3 Permissions Setup

To use CloudCrumbs with your AWS CloudTrail logs, you need to create an AWS IAM user with appropriate permissions to read and fetch files from the S3 bucket containing your CloudTrail logs.

Prerequisites

  • Access to AWS IAM console
  • Administrator permissions or IAM management permissions
  • Knowledge of your CloudTrail S3 bucket name and region

Step 1: Create IAM User

  1. Log in to the AWS Management Console
  2. Navigate to IAM service
  3. Click "Users" in the left sidebar
  4. Click "Create user"
  5. Enter a username (e.g., cloudcrumbs-user)
  6. Select "Programmatic access" for access type
  7. Click "Next: Permissions"

Step 2: Create Custom Policy

  1. In the IAM console, go to "Policies"
  2. Click "Create policy"
  3. Select the "JSON" tab
  4. Replace the default content with the following policy:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-CLOUDTRAIL-BUCKET-NAME",
                "arn:aws:s3:::YOUR-CLOUDTRAIL-BUCKET-NAME/*"
            ]
        }
    ]
}
  1. Replace YOUR-CLOUDTRAIL-BUCKET-NAME with your actual CloudTrail S3 bucket name
  2. Click "Next: Tags" (optional)
  3. Click "Next: Review"
  4. Enter a policy name (e.g., CloudCrumbsS3ReadAccess)
  5. Add a description (e.g., "Allows CloudCrumbs to read CloudTrail logs from S3")
  6. Click "Create policy"

Step 3: Attach Policy to User

  1. Go back to the IAM Users section
  2. Click on your newly created user
  3. Click "Add permissions"
  4. Select "Attach existing policies directly"
  5. Search for and select the policy you just created
  6. Click "Next: Review"
  7. Click "Add permissions"

Step 4: Generate Access Keys

  1. In the user details page, click the "Security credentials" tab
  2. Scroll down to "Access keys" section
  3. Click "Create access key"
  4. Select "Application running outside AWS" as the use case
  5. Click "Next"
  6. Add a description tag (optional)
  7. Click "Create access key"
  8. Important: Download the CSV file or copy the Access Key ID and Secret Access Key immediately