With our AWS S3 integration, you can attach files to evidence directly from your S3 buckets. Using a centralized storage location like S3 means helps increase efficiency (one less step in collecting evidence), data security (no need to download sensitive files onto your desktop first), and reduce clutter (collect directly from the single source of truth).

You can store almost any type of evidence in Amazon S3 and using a centralized storage system like S3 may help you keep your evidence organized as you're collecting it.

S3 is also especially useful for storing system settings, log files, and other evidence needed to identify your network and application systems.

Follow the instructions on this page to get started collecting evidence from Amazon S3.

To configure the integration with AWS S3, someone in your organization will need access to configure a new AWS IAM role and policy that gives Strike Graph permission to access their bucket and its contents.

IAM Role: an AWS IAM role includes a trust policy associated with Strike Graph, and provides us with temporary credentials to access to very specific information, in this case a policy with S3 bucket access permissions.

Policy: an AWS policy can be associated with an IAM Role, and grants specific permissions. You will need to create a policy allowing access to an S3 bucket.

To fully complete the process of integrating an S3 bucket with Strike Graph, you will need two pieces of information: the IAM ROLE ARN, and the S3 bucket name.

This role will include a Trust Policy that allows Strike Graph to assume this role, and from there, access the buckets defined in this Role’s policies. You will need two pieces of information to set up the AWS Role and trust policy:

Both of these variables can be grabbed from the Integrations Manager configuration screen inside the Amazon S3 card.

In your AWS console:

Navigate to Services → IAM and find and click on the "Create role" button.

Under "type of trusted entity" select "Another AWS account"

Click the "Next: Permissions" button in the bottom right to advance to the next screen. This page will allow you to create an associated permissions policy.

On the permissions page, click "Create policy" — this will open a new window where users can create a new policy.

Select the JSON tab:

Copy the JSON snippet from the Integrations Manager and paste it into AWS. Replace "INSERTBUCKETNAME" with your desired bucket.

Click next until you reach the Review screen, where you can name the policy and finalize by clicking "Create Policy".

Associate the new Role with the new Policy

Navigate back to the browser window where you left the original Role screen open. Click the refresh symbol and then select your newly created policy.

Click "Next" on the bottom right until you get to the Review screen. Give your new role a meaningful name and description (so you remember it's purpose later) and then click "Create role".

Back in Strike Graph:

Once you have activated an Amazon S3 integration, you can use it to attached files directly from your bucket to your evidence items.

We support most file types through the S3 integration, see our full list here.

You can remove the integration at any time. Please note that removing an integration does not delete any files that were attached used during that integration. Removing an integration may also disrupt automated collection.

To remove:

Note: You may have access to remove integrations for other users on your team.

With Automated Collection, Strike Graph can recollect evidence attachments from your S3 buckets a few days before expiration so that your evidence remains in an effective 'audit ready' state. More information is available here about configuring Automated Collection for your evidence.

Because the AWS S3 integration collects evidence attachments based on a specific file key, for Automated Collection to continue to get the most up-to-date copies of the evidence, you should keep the same file current with any changes you intend to be automatically collected. This typically means utilizing S3 file versioning, and updating the existing file with an updated copy.

Reach out through our chat feature for real-time Customer Success support 8 am - 5 pm PT Monday through Friday.