You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/send-data/hosted-collectors/amazon-aws/aws-s3-source.md
+8-17Lines changed: 8 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -75,7 +75,7 @@ Cisco Umbrella offers logging to a Cisco-managed S3 bucket. Collection from thes
75
75
76
76
Sumo’s S3 integration combines scan-based discovery and event based discovery into a unified integration that gives you the ability to maintain a low-latency integration for new content and provide assurances that no data was missed or dropped. When you enable event based notifications S3 will automatically publish new files to Amazon Simple Notification Service (SNS) topics which Sumo Logic can be subscribed. This notifies Sumo Logic immediately when new files are added to your S3 bucket so we can collect them. For more information about SNS, see the [Amazon SNS product](https://aws.amazon.com/sns/) detail page.
77
77
78
-

78
+
<img src={useBaseUrl('img/send-data/Cloud_AWS_icon.png')} alt="Diagram of AWS and Sumo Logic integration for S3 object notifications" width="600" />
79
79
80
80
Enabling event based notifications is an S3 bucket-level operation that subscribes to an SNS topic. An SNS topic is an access point that Sumo Logic can dynamically subscribe to in order to receive event notifications. When creating a Source that collects from an S3 bucket Sumo assigns an endpoint URL to the Source. The URL is for you to use in the AWS subscription to the SNS topic so AWS notifies Sumo when there are new files. See [Configuring Amazon S3 Event Notifications](https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html) for more information.
81
81
@@ -88,14 +88,8 @@ You can adjust the configuration of when and how AWS handles communication attem
88
88
1. Select **Amazon S3**.
89
89
1. Enter a name for the new Source. A description is optional.
90
90
1. Select an **S3 region** or keep the default value of **Others**. The S3 region must match the appropriate S3 bucket created in your Amazon account. Selecting an AWS GovCloud region means your data will be leaving a FedRAMP-high environment. Use responsibly to avoid information spillage. See [Collection from AWS GovCloud](collection-aws-govcloud.md) for details.
91
-
1.**Use AWS versioned APIs**? Select **Yes** to collect from buckets where versioning is enabled. This uses the list-bucket-versions and get-object-version Amazon S3 APIs. Selecting **Yes** requires your credentials to have **ListBucketVersions** and **GetObjectVersion** permissions.
92
-
93
-

94
-
95
-
1. For **Bucket Name**, enter the exact name of your organization's S3 bucket. Be sure to double-check the name as it appears in AWS, for example:
96
-
97
-

98
-
91
+
1.**Use AWS versioned APIs**? Select **Yes** to collect from buckets where versioning is enabled. This uses the list-bucket-versions and get-object-version Amazon S3 APIs. Selecting **Yes** requires your credentials to have **ListBucketVersions** and **GetObjectVersion** permissions.<br/><img src={useBaseUrl('img/send-data/versioned-apis-options.png')} alt="Radio button selection for using AWS versioned APIs" style={{border: '1px solid gray'}} width="500" />
92
+
1. For **Bucket Name**, enter the exact name of your organization's S3 bucket. Be sure to double-check the name as it appears in AWS, for example:<br/><img src={useBaseUrl('img/send-data/S3_Bucket.png')} alt="List of buckets and objects in AWS S3" style={{border: '1px solid gray'}} width="800" />
99
93
1. For **Path Expression**, enter the wildcard pattern that matches the S3 objects you'd like to collect. You can use more than one wildcard (\*) in this string. Recursive path expressions use a multiple wildcard. Do **NOT** use a leading forward slash. [See About Amazon Path Expressions](amazon-path-expressions.md) for details.
100
94
101
95
Following is an example of a managed S3 bucket's name and path expression entered in the dialog. Together they comprise an S3 bucket data path. For more information, see [S3 Bucket Data Path](https://docs.umbrella.com/deployment-umbrella/docs/cisco-managed-s3-bucket#s3-bucket-data-path) in the Cisco documentation. <br/><img src={useBaseUrl('img/send-data/bucket-name-and-path-expression.png')} alt="Input fields for Bucket Name and Path Expression in Sumo Logic." style={{border: '1px solid gray'}} width="600" />
@@ -124,10 +118,7 @@ You can adjust the configuration of when and how AWS handles communication attem
124
118
125
119
1. For **AWS****Access** you have two **Access Method** options. Select **Role-based access** or **Key access** based on the AWS authentication you are providing. Role-based access is preferred, this was completed in the prerequisite step [Grant Sumo Logic access to an AWS Product](grant-access-aws-product.md). If you're collecting from a Cisco Umbrella bucket you must use **Key access**.
126
120
127
-
* For **Role-based access** enter the Role ARN that was provided by AWS after creating the role.
128
-
129
-

130
-
121
+
* For **Role-based access** enter the Role ARN that was provided by AWS after creating the role. <br/><img src={useBaseUrl('img/send-data/Role-based-access-input-roleARN.png')} alt="AWS Access method selection screen with role-based access" style={{border: '1px solid gray'}} width="500" />
131
122
* For **Key access** enter the **Access Key ID** and **Secret Access Key.** See [AWS Access Key ID](http://docs.aws.amazon.com/STS/latest/UsingSTS/UsingTokens.html#RequestWithSTS) and [AWS Secret Access Key](https://aws.amazon.com/iam/) for details.
132
123
133
124
1.**Log File Discovery.** You have the option to set up Amazon Simple Notification Service (SNS) to notify Sumo Logic of new items in your S3 bucket. A scan interval is required and automatically applied to detect log files.
@@ -143,7 +134,7 @@ You can adjust the configuration of when and how AWS handles communication attem
143
134
144
135
To set up the subscription you need to get an endpoint URL from Sumo to provide to AWS. This process will save your Source and begin scanning your S3 bucket when the endpoint URL is generated. Click on **Create URL** and use the provided endpoint URL when creating your subscription in step C.
145
136
146
-

@@ -206,7 +197,7 @@ When collecting from one Amazon S3 bucket with multiple Sumo Sources, you need t
206
197
207
198
Each topic needs a separate filter (prefix/suffix) so that collection does not overlap. For example, the following image shows a bucket configured with two notifications that have filters (prefix/suffix) set to notify Sumo separately about new objects in different folders.
208
199
209
-

200
+
<img src={useBaseUrl('img/send-data/S3-bucket-two-notifications-for-SNS.png')} alt="Events filter settings for SNS notifications in AWS S3" style={{border: '1px solid gray'}} width="400" />
210
201
211
202
### Update Source to use S3 Event Notifications
212
203
@@ -222,7 +213,7 @@ There is a [community supported script](https://github.com/SumoLogic/sumologic-
222
213
223
214
In the web interface under **Log File Discovery** it shows a red exclamation mark with "Sumo Logic has not received a validation request from AWS".
In the web interface under **Log File Discovery** it shows a green check with "Sumo Logic has received an AWS validation request at this endpoint." but you still have high latencies.
234
225
235
-

Copy file name to clipboardExpand all lines: docs/send-data/hosted-collectors/amazon-aws/configure-your-aws-source-cloudformation.md
+8-14Lines changed: 8 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,13 +19,11 @@ You can use either the [AWS Command Line Interface](https://aws.amazon.com/cli/)
19
19
20
20
Both methods require a YAML file with the template. You can create a file with the provided [YAML template](#yaml-template-to-create-topic-and-sns-subscription) or download the template from the Sumo interface. When creating the Source click **Create URL** and a **Generate event-based polling template** button becomes available.
## Create a Stack on the AWS CloudFormation console
25
25
26
-
1. Visit **Services > [Cloudformation](https://console.aws.amazon.com/cloudformation/home) > Create Stack > Upload a template to Amazon S3** and upload the file with the CloudFormation template and click **Next**. See [Selecting a Stack Template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html) for details.
27
-
28
-

26
+
1. Visit **Services > [Cloudformation](https://console.aws.amazon.com/cloudformation/home) > Create Stack > Upload a template to Amazon S3** and upload the file with the CloudFormation template and click **Next**. See [Selecting a Stack Template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html) for details.<br/><img src={useBaseUrl('img/send-data/upload-template-when-creating-cloudformation-stack.png')} alt="Upload template when creating cloudformation stack" style={{border: '1px solid gray'}} width="800" />
29
27
30
28
:::note
31
29
Make sure that the AWS region is the same as the S3 bucket when uploading the template.
@@ -36,8 +34,8 @@ Both methods require a YAML file with the template. You can create a file with t
36
34
:::note
37
35
If you downloaded and used the template from the Sumo interface AWS will not prompt you for **Parameters**.
1. Options can remain the default, click **Next** again. Review for mistakes then click **Create**.
43
41
@@ -116,9 +114,9 @@ Resources:
116
114
117
115
You can grant Sumo Logic access to your AWS Product with an IAM Role using CloudFormation. You can use the [AWS Command Line Interface](https://aws.amazon.com/cli/) (CLI) or [create a stack on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html).
118
116
119
-
1. Both methods require a YAML file with the CloudFormation template. You can create a file with the provided [YAML template](#yaml-template-toset-up-an-iam-role) or download a generated template from the Sumo interface when creating your Source by clicking the **Generate role-based access template** button. The button will only become available after you input the bucket name.
117
+
Both methods require a YAML file with the CloudFormation template. You can create a file with the provided [YAML template](#yaml-template-toset-up-an-iam-role) or download a generated template from the Sumo interface when creating your Source by clicking the **Generate role-based access template** button. The button will only become available after you input the bucket name.
120
118
121
-

@@ -138,12 +136,8 @@ You can grant Sumo Logic access to your AWS Product with an IAM Role using Clo
138
136
139
137
## Create a Stack on the AWS CloudFormation console
140
138
141
-
1. Visit **Services > [Cloudformation](https://console.aws.amazon.com/cloudformation/home ) > Create Stack > Upload a template to Amazon S3** and upload the file with the CloudFormation template and click **Next**. See [Selecting a Stack Template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html) for details.
142
-
143
-

144
-
145
-
1. Specify Details. Provide an appropriate **Stack Name**. Then click **Next**. See [Specifying Stack Name and Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-parameters.html) for details.
146
-

139
+
1. Visit **Services > [Cloudformation](https://console.aws.amazon.com/cloudformation/home ) > Create Stack > Upload a template to Amazon S3** and upload the file with the CloudFormation template and click **Next**. See [Selecting a Stack Template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html) for details.<br/><img src={useBaseUrl('img/send-data/upload-template-when-creating-cloudformation-stack.png')} alt="Upload template when creating CloudFormation stack" style={{border: '1px solid gray'}} width="800" />
140
+
1. Specify Details. Provide an appropriate **Stack Name**. Then click **Next**. See [Specifying Stack Name and Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-parameters.html) for details.<br/><img src={useBaseUrl('img/send-data/specify-details-no-params.png')} alt="Specify details no params" style={{border: '1px solid gray'}} width="800" />
147
141
148
142
1. Options can remain default, click **Next** again. Review and check the box, “I acknowledge that AWS CloudFormation might create IAM resources.” and then click **Create**.
0 commit comments