Views:

Deploy File Security Storage to a single AWS account using AWS CloudFormation at the same time as you add the account to the Cloud Accounts app.

File Security Storage provides easy deployment using AWS CloudFormation to integrate automated scanning of files as you upload them into your storage and effortlessly detect all types of malware including viruses, trojans, spyware, and more. You can apply them to either a single or an organization account.
File Security Storage also supports using an IAM Permissions Boundary. You specify the IamPermissionsBoundaryArn to apply this boundary policy when configuring your CloudFormation template.
Note
Note
If you specify an IamPermissionsBoundaryArn during stack deployment, the IAM policy associated with the ARN must include the minimum permissions required by the features you enable. The permissions boundary applies to IAM roles created for Cloud Detections for AWS CloudTrail (including Control Tower), Cloud Detections for Amazon Security Lake, and File Security Storage. Refer to the permissions listed onAWS required permissions to ensure your boundary policy includes the required actions.
Note
Note
When you add a bucket to your CloudFormation template, it does not immediately appear in the File Security Inventory. The Inventory is updated when TrendAI Vision One™ carries out its scheduled asset sync. This occurs every hour for licensed TrendAI Vision One™ users and once per day for non-licensed users. To have the bucket added in real-time, you can enable Real-Time Posture Monitoring.
You can deploy File Security Storage when adding an AWS account to TrendAI Vision One™.

Procedure

  1. In the TrendAI Vision One™ console, go to Cloud Security → File Security → Cloud Accounts → Inventory → AWS.
  2. Click Add Cloud Account.
  3. Click Single Account.
  4. In the Account Name field, enter a name for the AWS account.
  5. You can add a Description of the account to help identify it.
  6. In the All Features list, scroll down and enable File Security Storage.
  7. Open the File Security Storage section.
  8. From the Deployment list, select at least one region. This is the region where you will deploy File Security Scanner.
  9. In a new browser tab, log in to your AWS account.
  10. Go back to the TrendAI Vision One™ console and click Launch Stack.
    Clicking Launch Stack opens the Quick create stack screen in your AWS account in the browser tab that you opened in the previous step.
  11. Scroll down to the File Security Storage section, and provide the following parameters:

    File Security Storage CloudFormation parameters

    Parameter
    Description
    FileSecurityStorageKMSKeyARNsForBucketSSE
    Provide a comma-separated list of KMS key ARNs used for SSE-KMS encryption of customer-provided quarantine, clean, and failure buckets, as well as source buckets with SSE-KMS enabled. Leave this field blank if SSE-KMS is not enabled for the post-scan or source buckets.
    Note
    Note
    If you use SSE-KMS encryption on either scanned source buckets or customer-provided post-action buckets, you must provide the corresponding KMS Key ARN in this parameter.
    FileSecurityStorageObjectCreatedEventFilter
    Provide a JSON string of the event pattern to filter the object-created event.
    FileSecurityStorageScannerEphemeralStorage
    Provide the size, in MBs, of the scanner Lambda function's temp directory.
    FileSecurityStorageQuarantineBucket
    Enter the bucket in which you want to quarantine malicious files. By default this parameter is global, but you can make it by-region or a combination of both global and by-region. For more information, see Add by-region quarantine and promote buckets in single accounts. Leave this field blank to disable quarantining. (Single account only)
    FileSecurityStorageCleanBucket
    Enter the bucket in which you want to promote clean files after scanning. By default this parameter is global, but you can make it by-region or a combination of both global and by-region. For more information, see Add by-region quarantine and promote buckets in single accounts. Leave this field blank to disable promoting clean files. (Single account only)
    FileSecurityStorageFailureBucket
    Enter the bucket in which you want to isolate files that could not be scanned. You must specify if you want the parameter to be global or by-region. For more information, see Add a failed scan bucket. (Single account only)
    FileSecurityStorageScanResultTagFormat
    Enter the format of the scan results tagged on the scanned object.
    FileSecurityStorageEnableQuarantine
    Select "true" to enable the feature or "false" to disable the feature. If you enable the feature but do not provide a quarantine bucket, File Security Storage creates a quarantine bucket. If you enable the feature and provide a quarantine bucket, File Security Storage uses the provided bucket.
    FileSecurityStorageEnablePromote
    Select "true" to enable the feature or "false" to disable the feature. If you enable the feature but do not provide a promote bucket, File Security Storage creates a promote bucket. If you enable the feature and provide a promote bucket, File Security Storage uses the provided bucket.
    FileSecurityStorageEnableIsolate
    Select "true" to enable the feature or "false" to disable the feature. If you enable the feature but do not provide an isolate bucket, File Security Storage creates an isolate bucket. If you enable the feature and provide an isolate bucket, File Security Storage uses the provided bucket.
    SyncBucketsEventBridge
    Select "true" to sync EventBridge settings for default monitoring of the buckets. Note that if you are updating a stack, you need to download the template every time using the cloud account management console and going to the AWS CloudFormation console to update the template with the "Replacing existing template" option.
    FileSecurityStorageUseSourceBucketAsFolder
    Select "true" to enable the feature or "false" to disable the feature. If you enable the feature, each source bucket becomes a folder in the destination bucket, keeping files from different source buckets separated. When false, all files are written to the destination root with their original keys; files with the same name from different source buckets will overwrite each other.
    Note
    Note
    Parameters marked (Single account only) are not available in the AWS Organization template. For more information, see Deploy File Security Storage to an AWS Organization account.
  12. Scroll to the bottom of the Quick create stack screen, select the acknowledgment options, and click Create stack.
  13. In the TrendAI Vision One™ console, click Done.

Next steps

Now you need to enable the scanner for the buckets in each region that you enabled in your template. You enable the scanners by turning on EventBridge. Only buckets whose EventBridge has been enabled in the File Security Storage console are scanned. Buckets whose EventBridge was enabled in the AWS console are not scanned.
Note
Note
When you enable scanning, File Security Storage does not scan the files that are currently in the bucket. To scan the existing files, you need to run a manual scan. For more information, see Manual Scans for AWS buckets.
The first time you deploy a File Security Storage stack, it monitors all the S3 buckets that have EventBridge turned on. When you add or remove monitoring buckets, File Security Storage stores the list of monitoring buckets in its configuration and scans buckets based on that configuration. This behavior exists for backward compatibility: when you update the old File Security Storage template (in which the monitoring buckets were based solely on whether EventBridge was on) to the enhanced version (in which the monitoring buckets are based on your choices in the console), you remain protected without having to reconfigure the monitoring buckets.
  • Before stack version 1.2.0, you need to turn on or turn off EventBridge to control whether the scanning is enabled or not.
  • In stack versions 1.2.0 or greater, File Security Storage creates an S3 configuration bucket in your environment. It uses the information in this configuration bucket to determine whether to scan a specific bucket. Every time you turn on scanning, File Security Storage enables EventBridge. However, if you turn off scanning, File Security Storage does not disable EventBridge, but rather saves the current scanning status in the configuration bucket.
  • If you have already installed an enhanced version and update the template to get new features, the monitoring bucket configuration remains, so your previous monitoring settings still protect you. If, however, you remove the existing stack and then install a new stack instead of updating the stack, File Security Storage considers this a new installation, and you lose the previous settings.