Stream Logs to Amazon S3

Netskope Log Streaming supports sending log files to Amazon S3. Provide details for the selected destination type. Destinations supported might offer different features and capabilities. The fields to fill in differ depending on the destination type the user selects.

For the Amazon S3 destination field, fill in the following fields:

• Name of Destination:  A human-readable description for the destination.
• Bucket: The name of the user’s Amazon S3 bucket (e.g., netskopepartnerlogfilebucket).
• Folder Path (optional): The path to the folder within the bucket where the user wants to store and save their logs. If the folders don’t exist in the bucket, Amazon creates them—for example, logs or logs/diagnostics. Amazon treats objects that end with / as folders. For example, if you start your path with /, as in /logs, Amazon creates two folders in your bucket. The first one is named /, and it contains the logs folder. To learn more: Using folders in AWS and Bucket naming rules in Amazon S3. NOTE: Do not start your path with a / unless you intend to create a root-level folder named /.

Access

Select your preferred authentication method. IAM Role is recommended for enhanced security.

Option 1: IAM Role (Recommended)

This method uses a trust relationship between your AWS account and Netskope, eliminating the need for long-lived credentials.

• IAM Role ARN: Enter the Amazon Resource Name (ARN) of the IAM role you created in your AWS account for Netskope. To learn more: AWS setup details 
• Netskope Account ID: This is a read-only field (e.g., 448000000000). You must copy this ID and add it to the Trust Policy of your IAM Role in the AWS Console to allow Netskope to write to your bucket.

Option 2: Access Keys

• Access Key ID: The Access Key ID to the S3 bucket, provided by AWS.
• Secret Access Key: The Secret Access Key to the S3 bucket, provided by AWS.

Region & Delivery

• Region: The AWS services region where your S3 bucket is hosted (e.g., us-east-1).

Set up IAM on Your Account

1. Create an IAM role.
2. Update the Roles Trust Relationship with the policy below.
3. Update the Roles Permission to include the s3 bucket write permission.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": [
					"arn:aws:iam::<netskopeaccount-id>:root"
				]
			},
			"Action": [
				"sts:AssumeRole"
			]
		}
	]
}

Set up IAM on Your Account with ExternalId

1. Create an IAM role.
2. Update the Roles Trust Relationship with the policy below and note the condition which passes the externalId value.
3. Update the Roles Permission to include the s3 bucket write permission.
4. Use the IAM Role ARN and the externalID value when configuring the stream.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": [
					"arn:aws:iam::<netskopeaccount-id>:root"
				]
			},
			"Action": [
				"sts:AssumeRole"
			],
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "externalIdNetskopeLogStreaming"
                }
            }
		}
	]