Skip to content

AWS S3 Guide

Screenshot

Satori streamlines and simplifies the process of controlling access to data in AWS S3. Satori reduces the risk of data leakage caused by misconfiguring users or permissions. When using Satori to deliver access to data in AWS S3, organizations provision a single set of AWS credentials that are only used by the Satori DAC to access AWS S3. Satori generates temporary credentials for data consumers instead of their existing AWS credentials. The benefits of this approach are as follows:

  1. There is no need to create an AWS IAM user for each data consumer, for reducing the risk of granting access to AWS resources that users do not require.
  2. Auditing user access to data in AWS S3 is performed via Satori, without requiring you to activate native AWS logging which does not differentiate between user and machine access.

Note: Satori protects S3 data using Satori Datasets, Dataset Permissions, and Auditing. Security policies and Masking Profiles are not supported on AWS S3 data stores.

ENFORCING SECURITY POLOCIES: To enforce security policies on data in S3, data must be queried via one of the supporting data stores such as AWS Athena, AWS Redshift Spectrum and Snowflake.

S3 Tutorial and Overview

Prerequisites

Perform the following steps to grant Satori access to AWS S3.

Step 1: Create an IAM Policy for Satori

An IAM policy is required to allow access to any S3 resources the data store protects. The following example provides you with an IAM policy you can use as a starting point to create your own IAM policy:

  • Replace <bucket1> and <bucket2> with your bucket names
  • Replace the <1.1.1.1>, <2.2.2.2>, <3.3.3.3> IPs with the IPs of your DAC
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUsersToListAllBucketsInAccount",
            "Action": [
                "s3:ListAllMyBuckets",
                "s3:GetBucketLocation"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:s3:::*"
            ],
            "Condition": {
                "ForAnyValue:IpAddress": {
                    "aws:SourceIp": [
                        "<1.1.1.1>",
                        "<2.2.2.2>",
                        "<3.3.3.3>"
                    ]
                }
            }
        },
        {
            "Sid": "AllowUsersToListObjectsInBuckets",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket1>",
                "arn:aws:s3:::<bucket2>"
            ],
            "Condition": {
                "ForAnyValue:IpAddress": {
                    "aws:SourceIp": [
                        "<1.1.1.1>",
                        "<2.2.2.2>",
                        "<3.3.3.3>"
                    ]
                }
            }
        },
        {
            "Sid": "AllowUsersToReadAndWriteObjectsInBuckets",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<bucket1>/*",
                "arn:aws:s3:::<bucket2>/*"
            ],
            "Condition": {
                "ForAnyValue:IpAddress": {
                    "aws:SourceIp": [
                        "<1.1.1.1>",
                        "<2.2.2.2>",
                        "<3.3.3.3>"
                    ]
                }
            }
        }
    ]
}

Creating an IAM Policy for Satori

Perform the following steps to create the IAM policy for Satori:

  1. Go to AWS IAM
  2. Click on Policies and select Create Policy
  3. Click the JSON tab and paste the JSON policy file that you created.
  4. Complete the policy creation process and name your policy, for example: satori_s3_policy.

Step 2: Create an IAM User for Satori

  1. Go to AWS IAM.
  2. Click on Users and select Add Users.
  3. Enter satori_s3_user in the Username input field and check the Access key - Programmatic access checkbox.
  4. Select Attach Existing Policy and search for the policy created in the previous step.
  5. Now, attach the policy to the user.
  6. In the last step of the process, copy the AWS Access Key ID and Secret Access Key.

Adding an AWS S3 Data Store to Satori

Screenshot

Perform the following steps to add an AWS S3 data store to your Satori account:

  1. Login to the Satori Management Console.
  2. In the Data Stores view, click the plus button to Add a New Data Store.
  3. Select the AWS S3 option.
  4. Provide an informative name for the data store, for example: S3 US-East-1.
  5. Select the Amamzon S3 AWS Region where your data is hosted, for example: us-east-1.
  6. Choose a Data Access Controller to use for this data store by selecting the Cloud provider and Region.
  7. Enter the AWS Account ID for the S3 data store.
  8. Enter the AWS Access Key ID and Secret Access Key you copied in the previous step.
  9. Click the Add New Data Store button.
  10. Satori will then validate that the credentials and AWS Account ID match
  11. You will be redirected to the Data Stores List View.

Connect to AWS S3 via Satori

Each user can generate personal credentials from the Satori Data Portal. In this option, <SATORI_USERNAME> and <SATORI_PASSWORD> shown in the example below refer to the generated username and password.

Connecting with the AWS Command Line

To connect to S3 via Satori using the AWS command line, first create a profile using your personal credentials. For example:

export AWS_ACCESS_KEY_ID='<SATORI_USERNAME>'
export AWS_SECRET_ACCESS_KEY='<SATORI_PASSWORD>'

Then add the endpoint-url parameter to your aws s3 command with the Satori hostname for the data store. For example: aws s3 ls --endpoint-url https://s3.us-east-1.a.p0.satoricyber.net.

Connecting with Python

To connect to S3 via Satori using Python, set the endpoint_url argument to the client function and configure the client to use path-style addressing. For example:

import boto3
from botocore.client import Config

client = boto3.client(
  service_name='s3',
  region_name='us-east-1',
  endpoint_url='https://s3.us-east-1.a.p0.satoricyber.net',
  aws_access_key_id='<SATORI_USERNAME>',
  aws_secret_access_key='<SATORI_PASSWORD>'
  config=Config(s3={'addressing_style': 'path'})
)

Connecting with Java

To connect to S3 via Satori using the AWS Java SDK, set the serviceEndpoint parameter and configure the client to use path-style addressing. For example:

import com.amazonaws.auth.AWSStaticCredentialsProvider;
import com.amazonaws.auth.BasicAWSCredentials;
import com.amazonaws.client.builder.AwsClientBuilder.EndpointConfiguration;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3ClientBuilder;

class S3Example {

    public static void main(String[] args) {
      AmazonS3ClientBuilder s3Builder = AmazonS3ClientBuilder
          .standard()
          .withPathStyleAccessEnabled(true);

      s3Builder.setEndpointConfiguration(
          new EndpointConfiguration("https://s3.us-east-1.a.p0.satoricyber.net", "us-east-1")
      );

      s3Builder.setCredentials(
          new AWSStaticCredentialsProvider(
              new BasicAWSCredentials("<SATORI_USERNAME>", "<SATORI_PASSWORD>")
          )
      );

      AmazonS3 s3 = s3Builder.build();
      s3.listBuckets();
    }

}

Connecting with Cyberduck

To connect to S3 via Satori using Cyberduck, enable the S3 (Deprecated path style requests) connection profile in the Profiles preferences ta. Screenshot

To create a new connection, click the Open Connection button, select the S3 (Deprecated path style requests) profile and then enter the Satori hostname in the Server field (without https://):

Screenshot

Network Policy Settings

Satori provides you with the ability to define your network security policy for your data store.

Screenshot

Simply, specify which IP addresses and subnet masks should be allowed access to the Data Store and which IP addresses and subnet masks should be blocked. Note that by default, Satori allows all IP address ranges if you leave the form empty.

Example 1

To allow all IP addresses - Leave the form empty. Screenshot

Example 2

To block specific IP addresses - Add them to the blocked IP address list. Screenshot

Example 3

To only allow access to specific IP addresses - Add them to the allow list. Note: Access from all other IP addresses ware blocked. Screenshot

Example 4

To allow access from a specific IP address range while blocking parts of the range - Add the IP range to the list of allowed IP addresses and add the IP address that you wish to block to the Block list. Screenshot