Skip to main content

​
Configure a Cloud Account

Cloud Account configuration wizard for AWS showing the initial setup form
Additional Costs for Using Cloud Compass with AWSThere could be additional costs for enabling Cloud Compass with AWS that only comes from outbound S3 traffic. This refers to data transferred from S3 buckets to external destinations, which will be charged according to AWS’s standard S3 outbound data transfer rates.

​
Requirements

​
Ensure Active Cloud Trail

  • Open the AWS Console and login to the relevant account
  • Go to CloudTrail and in the left hand side menu select Trails
  • Make sure the trail is in a Logging status AWS CloudTrail Trails list showing a trail in Logging status

​
Grant Bucket Permissions

  • Go to S3 Console and choose the relevant bucket based on the name of the S3 bucket in the Trails. You can also click on the bucket name from the previous image.
  • Choose permission tab S3 bucket details page with the Permissions tab selected for the CloudTrail log bucket
  • Go To Bucket Policy and click Edit
  • S3 bucket policy section with the Edit button to add the env zero read policy Add the following policy to the list:
    Policy
  • Replace the placeholder <replace-by-bucket-name>with the bucket name.
  • Click on the Save Changes button
  • Click on the edit button in the Object Ownership section
S3 bucket Object Ownership section with the edit button to select ACLs disabled mode
  • Select the ACLs disabled (recommended) option and click on the Save Changes button
Object Ownership ModeWe only able to read the cloud trails events when the Object Ownership in mode “ACLs disabled”S3 bucket Object Ownership set to ACLs disabled (recommended) option selected

​
Grant Decrypt Permission

  • This requirement is only necessary if encryption is enabled on the trail.
  • You can check if it is enabled by opening the trail and check if Log file SSE-KMS encryption is Enabled. AWS CloudTrail trail details showing Log file SSE-KMS encryption enabled status
  • If it is enabled, you should grant permission to the env zero role to decrypt the logs.
  • Open the “KMS Key Policy” - by clicking on the key URL from the previous image. AWS KMS Key Policy page showing the Edit button to add decrypt permission for the env zero role
  • Click Edit, and add this policy to the list:
    Policy
  • Click Save Changes

​
Setting Up Bucket Configuration

Here you should specify account config including:
  • Account name (for identification only)
  • Bucket Name [1]
  • Account ID [1]
  • Prefix [1] (optional) - this should match the prefix (if specified) when configuring the s3 bucket. See AWS docs.
  • Regions
[1] These fields are used to build the Scanned Bucket URL which will be used to fetch your cloud events. Bucket configuration form with fields for Account name, Bucket Name, Account ID, Prefix, and Regions Once you have created your account, env zero will start fetching historical data for the past 90 days. The Insights tab will show that a data fetching run has started. This process might take a few minutes, depending on the amount of events we need to ingest. Cloud Compass Insights tab showing a data fetching run in progress after account creation Once the data is ready, you will be able to start exploring the dashboard insights. For more information about using the dashboard, click here. env zero will now run on a daily basis to fetch new cloud activity, ensuring an accurate and up-to-date view of your cloud environment.

​
Next steps