AWS
Overview¶
Note
The prerequisites for Privacera Discovery are the same for both Self-Managed and PrivaceraCloud Data Plane deployments.
Privacera Discovery uses AWS services such as AWS S3 and DynamoDB to store configurations and metadata. For real-time scanning, AWS SQS is used. These resources can be created by Privacera Manager if you provide it with the necessary permissions. Alternatively, you can create these resources manually and configure their ARNs in Privacera Manager.
Prerequisite | Description |
---|---|
Additional IAM policy on PM EC2 instance | Additional IAM policies are needed on the Privacera Manager EC2 host to create AWS resources for Discovery, such as DynamoDB tables and SQS queues. |
AWS S3 bucket and path | The S3 bucket and path where the configurations and temporary files for Discovery are stored. |
AWS DynamoDB tables | Used to store metadata and tags. |
AWS SQS | Used when real-time scanning is enabled. The change events for the S3 objects are retrieved from the SQS queue. |
IAM Role for Discovery and Portal pods | IAM Role for Service Account (IRSA) for the Discovery driver, executor, consumer, and portal pods to access AWS resources. |
Additional IAM policy on PM EC2 instance¶
The following additional IAM policy must be attached to the Privacera Manager EC2 instance to enable the creation of AWS resources for Discovery, such as DynamoDB tables, S3 buckets, and SQS queues.
You can skip this step if you do not want Privacera Manager to create these resources. However, you will need to create the resources manually and provide their ARNs to Privacera Manager.
Additional IAM policy on PM EC2 instance
Replace the following placeholders
AWS_REGION: The AWS region where the resources are created.
ACCOUNT_ID: The AWS account ID where the resources are created.
DISCOVERY_BUCKET: The S3 bucket name where the Privacera meta-data is stored.
The table name and SQS queue name are in the format [privacera_*_DEPLOYMENT_ENV_NAME]
AWS S3 bucket and path¶
An AWS S3 bucket and path is required to store the configuration for Privacera Discovery. You can use an existing bucket and provide a path, or create a new bucket manually or let Privacera Manager create it for you. Note down the bucket name and path to be configured in Privacera Manager.
Info
The IAM role for Privacera Discovery pods and Privacera Portal pod will need read/write access to this bucket and, they will need read access to the buckets containing data to be scanned.
AWS DynamoDB Tables¶
AWS DynamoDB tables are required to store the metadata for Privacera Discovery. Privacera Manager will create these for you and append the DEPLOYMENT_ENV_NAME to the table names.
If you want to create them manually, you can use the following naming convention and schema. You will need to provide the table names to Privacera Manager during the installation configuration.
DynamoDB Table schema and naming convention
Override Variable | Table Name | Hash Key | Hash Key Type | Range Key | Range Key Type |
---|---|---|---|---|---|
SCAN_REQUEST_TABLE | privacera_scan_requests_DEPLOYMENT_ENV_NAME | scan_id | S | id | S |
RESOURCE_TABLE | privacera_resource_v2_DEPLOYMENT_ENV_NAME | appCode | S | id | S |
ALERT_TABLE | privacera_alert_DEPLOYMENT_ENV_NAME | d | S | id | S |
AUDIT_SUMMARY_TABLE | privacera_audit_summary_DEPLOYMENT_ENV_NAME | appCode | S | id | S |
ACTIVE_SCANS_TABLE | privacera_active_scans_DEPLOYMENT_ENV_NAME | topicName | S | id | S |
STATE_TABLE | privacera_state_DEPLOYMENT_ENV_NAME | id | S |
Table Naming Convention
The table names should be suffixed with the DEPLOYMENT_ENV_NAME (e.g. prod) to avoid conflicts with other deployments.
AWS SQS¶
An AWS SQS queue is used for bucket change notifications. Privacera Manager will create these for you and append the DEPLOYMENT_ENV_NAME to the queue name. You can use a different name for the SQS queue and provide the queue name to Privacera Manager during installation configuration.
If you want to create it manually then follow the following naming convention
SQS Queue naming convention
Bash | |
---|---|
IAM Role for Discovery and Portal pods¶
IAM Role for Service Account for Discovery driver, executor, Consumer and Portal pods
Pod level IAM roles are supported since Privacera Platform version 9.0.0.1. Prior to that you had to give these IAM policies to the nodes of the Kubernetes cluster
-
Create an IAM role named
privacera_discovery_consumer_DEPLOYMENT_ENV_NAME
and attach these policies to it.- IAM Policy to access DynamoDB tables
- IAM policy to access S3 bucket for Discovery configuration
Assign this policy to EKS service account
discovery-consumer-privacera-sa
for the Discovery consumer pod. Note down the ARN of this IAM role to be used to set value ofDISCOVERY_CONSUMER_IAM_ROLE_ARN
in the configuration section. -
Create an IAM role named
privacera_discovery_DEPLOYMENT_ENV_NAME
and attach these policies to it.- IAM Policy to access DynamoDB tables
- IAM policy to access S3 bucket for Discovery configuration
- IAM policy to access S3 bucket containing data to be scanned by Discovery (optional)
- IAM policy to access DynamoDB tables containing data to be scanned by Discovery (optional)
Assign this policy to EKS service account
discovery-privacera-sa
for the Discovery consumer pod, and to EKS service accountportal-privacera-sa
for Portal. Note down the ARN of this IAM role to be used to set value ofDISCOVERY_IAM_ROLE_ARN
andPORTAL_IAM_ROLE_ARN
-
Create an IAM role named
privacera_discovery_pkafka_DEPLOYMENT_ENV_NAME
and attach these policies to it.- IAM Policy to access SQS queue
Assign this policy to EKS service account
pkafka-privacera-sa
for the Discovery consumer pod. Note down the ARN of this IAM role to be used to set value ofPKAFKA_IAM_ROLE_ARN
in configuration section.
You can follow the instructions here for creating the IAM role for service accounts.
The IAM policies are given below.
Replace the following placeholders
AWS_REGION: The AWS region where the resources are created.
AWS_ACCOUNT_ID: The AWS account ID where the resources are created.
DEPLOYMENT_ENV_NAME: The Privacera deployment environment name.
DISCOVERY_CONFIG_BUCKET_NAME: The S3 bucket name where the Privacera configuration is stored.
DISCOVERY_SCAN_BUCKET_NAME1: The S3 bucket name where the data to be scanned is stored.
DISCOVERY_SCAN_BUCKET_NAME2: The S3 bucket name where the data to be scanned is stored.
IAM Policy to access DynamoDB tables (Discovery driver, executor and Consumer)
IAM policy to access S3 bucket for Discovery configuration (Discovery driver, executor and Consumer)
IAM policy to access SQS queue (Discovery pKafka). This is used only for real-time scanning (Optional)
IAM policy to scan S3 bucket containing data (Discovery driver, executor)(optional)
IAM policy to scan DynamoDB tables containing data(optional)(Discovery driver, executor)
- Prev Prerequisites
- Next Discovery Setup