{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition","partial"]},"type":"markdown"},"seo":{"title":"AWS Network Security Provider Configuration Guide","siteUrl":"https://docs.synqly.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This guide walks you through the steps to gather the necessary information and configure your AWS"," ","account for the purpose of creating an integration with Synqly's Network Security connector. AWS"," ","Network Security integrates Amazon VPC Flow Logs with Synqly."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":0},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure that you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://console.aws.amazon.com/"},"children":["AWS Management Console"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["VPC Flow Logs publishing to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html"},"children":["Amazon CloudWatch"," ","Logs"]}," and/or ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html"},"children":["Amazon"," ","S3"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to an AWS account with permission to create IAM policies, roles, and users"]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Synqly can discover flow log configurations that deliver to CloudWatch Logs or S3. Traffic event"," ","queries are supported for CloudWatch Logs Insights and for S3 objects in text or gzip format."," ","Kinesis Data Firehose destinations and S3 parquet delivery are not supported for traffic event"," ","queries."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"required-policy-actions","__idx":1},"children":["Required Policy Actions"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Operation"},"children":["Operation"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Required Policy Action(s)"},"children":["Required Policy Action(s)"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query Traffic Log Configurations"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ec2:DescribeFlowLogs"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Resolve account context"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sts:GetCallerIdentity"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query Traffic Events (CloudWatch Logs destination)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["logs:StartQuery"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["logs:GetQueryResults"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Query Traffic Events (S3 destination)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s3:ListBucket"]}," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["s3:GetObject"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your flow logs only publish to CloudWatch Logs, the S3 actions are not required. If your flow"," ","logs only publish to S3, the CloudWatch Logs actions are not required. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["sts:GetCallerIdentity"]}," is"," ","required for all setups — the client uses it at initialization to resolve the account ID (including"," ","when building S3 flow log prefixes)."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"example-iam-policy","__idx":2},"children":["Example IAM Policy"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Replace ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["YOUR_ACCOUNT_ID"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["YOUR_FLOW_LOG_BUCKET"]},", and any optional custom prefix to match your"," ","environment. Attach this policy (or an equivalent) to the IAM role or user you create in the"," ","credentials section below."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"DiscoverVpcFlowLogs\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\"ec2:DescribeFlowLogs\"],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"ResolveCallerIdentity\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\"sts:GetCallerIdentity\"],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"QueryCloudWatchFlowLogs\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\n        \"logs:StartQuery\",\n        \"logs:GetQueryResults\"\n      ],\n      \"Resource\": \"*\"\n    },\n    {\n      \"Sid\": \"ListS3FlowLogPrefix\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\"s3:ListBucket\"],\n      \"Resource\": \"arn:aws:s3:::YOUR_FLOW_LOG_BUCKET\",\n      \"Condition\": {\n        \"StringLike\": {\n          \"s3:prefix\": [\n            \"AWSLogs/YOUR_ACCOUNT_ID/*\",\n            \"OPTIONAL_CUSTOM_PREFIX/AWSLogs/YOUR_ACCOUNT_ID/*\"\n          ]\n        }\n      }\n    },\n    {\n      \"Sid\": \"ReadS3FlowLogObjects\",\n      \"Effect\": \"Allow\",\n      \"Action\": [\"s3:GetObject\"],\n      \"Resource\": [\n        \"arn:aws:s3:::YOUR_FLOW_LOG_BUCKET/AWSLogs/YOUR_ACCOUNT_ID/*\",\n        \"arn:aws:s3:::YOUR_FLOW_LOG_BUCKET/OPTIONAL_CUSTOM_PREFIX/AWSLogs/YOUR_ACCOUNT_ID/*\"\n      ]\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"aws-credentials-configuration","__idx":3},"children":["AWS Credentials Configuration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Synqly supports two methods for authenticating with AWS: static credentials (IAM user access keys)"," ","and role-based access (IAM role assumption). Role-based access is recommended for production"," ","environments because it uses short-lived credentials and provides better auditability through"," ","CloudTrail."]},{"$$mdtype":"Tag","name":"Tabs","attributes":{"size":"medium"},"children":[{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Role-Based Access","disable":false},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"role-based-access","__idx":4},"children":["Role-Based Access"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Role-Based access is recommended and is considered an ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-workloads-use-roles"},"children":["AWS best"," ","practice"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Role-based access uses AWS IAM roles to grant Synqly temporary credentials to access resources in"," ","your AWS account. This eliminates long-lived credentials and provides better security through the"," ","principle of least privilege."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"1-create-an-iam-role","__idx":5},"children":["1. Create an IAM Role"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create a role in your AWS account with a name that starts with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyAccess"]}," (for example,"," ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyAccessS3Reader"]},"). This naming convention is required."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the AWS IAM console, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Roles"]}," and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create role"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For trusted entity type, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Custom trust policy"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter the following trust policy:"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::733459310821:role/SynqlyIntegrationAccess\"\n      },\n      \"Action\": \"sts:AssumeRole\",\n      \"Condition\": {\n        \"StringEquals\": {\n          \"sts:ExternalId\": \"YOUR_EXTERNAL_ID\"\n        }\n      }\n    }\n  ]\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Replace ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["YOUR_EXTERNAL_ID"]}," with a unique identifier you generate (for example, a UUID). You will"," ","provide this External ID when configuring the integration."]},{"$$mdtype":"Tag","name":"ol","attributes":{"start":4},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Name the role with a ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyAccess"]}," prefix (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyAccessMyIntegration"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Attach the appropriate permissions policy for your use case."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create the role and note its ARN."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more details, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html"},"children":["Access to AWS accounts owned by third"," ","parties"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-custom.html"},"children":["Create a role using custom trust"," ","policies"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"external-id-requirements","__idx":6},"children":["External ID Requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The External ID is a security mechanism that prevents the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html"},"children":["confused deputy"," ","problem"]},". It ensures that"," ","only authorized requests from Synqly can assume your role."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The External ID must contain only the following characters:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Alphanumeric characters (a-z, A-Z, 0-9)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Special characters: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["+ = , . @ : / -"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Must be between 2 and 1224 characters in length"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuring-the-integration-credentials","__idx":7},"children":["Configuring the Integration Credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When creating an AWS integration in Synqly, provide the following configuration values based on your"," ","chosen authentication method."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential Parameter"},"children":["Credential Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role ARN"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ARN of the IAM role you created, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["arn:aws:iam::123456789012:role/SynqlyAccessMyIntegration"]},". The role name must start with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyAccess"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["External ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The External ID you specified in the role's trust policy. This value must match exactly"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Role Session Name"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OPTIONAL:"]}," A name for the role session. If not specified, Synqly generates a default session name"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Duration"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OPTIONAL:"]}," The duration of the role session in seconds. The value can range from 900 seconds (15 minutes) up to the maximum session duration configured on your role (default is 1 hour)"]}]}]}]}]}]},{"$$mdtype":"Tag","name":"TabItemFragment","attributes":{"label":"Static Credentials (IAM User)","disable":false},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"static-credentials-iam-user","__idx":8},"children":["Static Credentials (IAM User)"]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["AWS static credentials are ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["NOT RECOMMENDED"]}," for production systems. See the ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-workloads-use-roles"},"children":["AWS best"," ","practices"]}," ","for more details."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Static credentials consist of an Access Key ID and Secret Access Key associated with an IAM user."," ","Use this method for simpler setups."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"1-create-an-iam-user","__idx":9},"children":["1. Create an IAM User"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the AWS IAM console, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Users"]}," and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create user"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enter a user name (for example, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["SynqlyIntegration"]},")."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Do not enable console access; this user only needs programmatic access."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Under permissions, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Attach policies directly"]}," and attach the appropriate policy for your"," ","use case."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create the user."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"2-create-an-access-key","__idx":10},"children":["2. Create an Access Key"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Open the newly created user and choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Create access key"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["For the use case, choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Third-party service"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Create the key and securely copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Access Key ID"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Secret Access Key"]},"."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more details, see:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"},"children":["Managing access keys for IAM"," ","users"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access-keys-admin-managed.html"},"children":["How an IAM administrator can manage IAM user access"," ","keys"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"configuring-the-integration-credentials-1","__idx":11},"children":["Configuring the Integration Credentials"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["When creating an AWS integration in Synqly, provide the following configuration values based on your"," ","chosen authentication method."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Credential Parameter"},"children":["Credential Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Access Key ID"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Access Key ID from your IAM user's access key pair"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Secret Access Key"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The Secret Access Key from your IAM user's access key pair"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Session Token"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["OPTIONAL:"]}," A temporary session token. Only required if you are using temporary credentials from AWS STS."]}]}]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"configure-the-integration","__idx":12},"children":["Configure the Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Create your integration by supplying the following configuration values, in addition to the AWS"," ","credentials from the section above."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Integration Parameter"},"children":["Integration Parameter"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Region"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs.aws.amazon.com/global-infrastructure/latest/regions/aws-regions.html"},"children":["AWS region"]}," that contains the VPC Flow Logs to query. Example: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["us-east-1"]}]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Traffic Log Configuration IDs ",{"$$mdtype":"Tag","name":"em","attributes":{},"children":["(optional)"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["One or more VPC Flow Log IDs (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["fl-..."]},"). When omitted, all discoverable flow logs in the region are used"]}]}]}]}]}]},"headings":[{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Required Policy Actions","id":"required-policy-actions","depth":2},{"value":"Example IAM Policy","id":"example-iam-policy","depth":2},{"value":"AWS Credentials Configuration","id":"aws-credentials-configuration","depth":2},{"value":"Role-Based Access","id":"role-based-access","depth":3},{"value":"1. Create an IAM Role","id":"1-create-an-iam-role","depth":4},{"value":"External ID Requirements","id":"external-id-requirements","depth":3},{"value":"Configuring the Integration Credentials","id":"configuring-the-integration-credentials","depth":3},{"value":"Static Credentials (IAM User)","id":"static-credentials-iam-user","depth":3},{"value":"1. Create an IAM User","id":"1-create-an-iam-user","depth":4},{"value":"2. Create an Access Key","id":"2-create-an-access-key","depth":4},{"value":"Configuring the Integration Credentials","id":"configuring-the-integration-credentials-1","depth":3},{"value":"Configure the Integration","id":"configure-the-integration","depth":2}],"frontmatter":{"slug":"guides/provider-configuration/aws-networksecurity-setup","seo":{"title":"AWS Network Security Provider Configuration Guide"}},"lastModified":"2026-08-19T20:11:23.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/provider-configuration/aws-networksecurity-setup","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}