Add AWS stacks

• For Step 1:
  • Make sure you are signed in to the AWS account where you want to install the scanner stack.
• For Step 2:
  • Select the AWS region where you want to deploy the scanner stack. This region must:
    • be supported by File Storage Security. For details, see What regions are supported?.
  • (Optional) Select Review Stack to view the contents of the scanner stack before launching it.
• Select Launch Stack.

• Stack name: Specify the name of the stack. Example: Scanner-TM-FileStorageSecurity
• KMSKeyARNForQueueSSE: Optional. Either leave this field empty or specify the ARN of the KMS master key used to encrypt messages in SQS queues if you have enabled server-side encryption. Use the same KMS master key if you deploy the corresponding storage stack.

• Tip KMSKeyARNsForTopicSSE: Optional. Either leave this field empty or specify the ARN of the KMS master key used to encrypt messages in the SNS ScanResultTopic if you have enabled server-side encryption. Use the same KMS master key if you deploy the corresponding storage stack. If multiple storage stacks were deployed with different KMS master keys, provide the list ARNs of KMS master keys used to encrypt messages in the SNS ScanResultTopic.

• ScannerEphemeralStorage: The size of the scanner lambda function's temp directory in MB. The default value is 512, but it can be any whole number between 512 and 2048 MB. Configure a large ephemeral storage to scan larger files in zip files. For more information, see Configuring ephemeral storage. (In preview)
• PermissionsBoundary: Optional. Provide the ARN of a policy that will be used to set the permissions boundary for all the roles that will be created. For more details, see AWS permissions control and Permissions boundaries for IAM entities.
• AdditionalIAMPolicies: Optional. Provide a list of IAM policy ARNs to attach to all the roles that will be created. For more details, see AWS permissions control.
• Resource prefixes: Optional. Either leave these fields empty or specify the prefix of each resource type. For details, see Resource prefixes.
• Deploy in VPC: Optional. Either leave these fields empty or specify the VPC subnet IDs and security group IDs. For details see Deploy in VPC.
• Stack package location: Leave this field as-is. It is for internal use by File Storage Security.
• Version: Leave this field as-is. It is for versioning.
• File Storage Security management account: Leave this field as-is. The account number is: 415485722356. You'll be granting this account permission to manage your scanner stack. More specifically, this account has permission to:
  • Obtain the storage and scanner stacks' Lambda logs.
  • Update the ScannerLambda function, anti-malware pattern layers, and license layer in the stacks.
  • Send some of your organization's data to its own AWS SNS topic. For details on the data we collect, see our Data collection disclosure.
• Trend Micro Cloud One region: Leave this field as-is. It specifies the region to which the scanner and storage stacks will connect to for Cloud One services such as the File Storage Security console, event management services, and telemetry services. For more information, see Cloud One regions.
• ExternalID: Leave this field as-is. It is required for security purposes. For details, see Why do you need to use an external ID?
• At the bottom of the page, select the I acknowledge [...] check box.
• Select Create stack.

• For Step 1:
  • Make sure you are signed in to the AWS account where you want to install the storage stack.
• For Step 2:
  • Select the AWS region that corresponds to your S3 bucket to scan's region. For supported regions, see What regions are supported?
  • (Optional) Select Review Stack to view the contents of the storage stack before launching it.
  • (Optional) Select Share Link to obtain a link to the storage stack's CloudFormation template in AWS. You can share this link with others who need an additional storage stack either under the same AWS account or a different account.
• Select Launch Stack.

• Stack name: Specify the name of the stack. Example: FSSStorage2
• S3BucketToScan: Specify the name of your S3 bucket to scan, as it appears in S3. You can only specify one bucket. Example: my-s3-bucket-to-scan-02
• ObjectFilterPrefix: Optional. Provide a prefix of the objects you want to scan. If the s3:ObjectCreated:* event of the scanning bucket is partially in use, either provide a prefix that is not in use or use TriggerWithObjectCreatedEvent.
• KMSKeyARNForBucketSSE: Optional. Either leave this field empty or specify the ARN of the KMS master key used to encrypt S3 bucket objects if you have enabled SSE-KMS
• KMSKeyARNForTopicSSE: Optional. Either leave this field empty or specify the ARN of the KMS master key used to encrypt the SNS ScanResultTopic if you have enabled SNS encryption.
• TriggerWithObjectCreatedEvent:　Optional. If the s3:ObjectCreated:* event of the scanning bucket is in use, set this to false. For more details on how to trigger the scan afterward, see s3:ObjectCreated:* event in use.
• ReportObjectKey:　Optional. Enable this to report the object keys of the scanned objects to File Storage Security backend services. File Storage Security can then display the object keys of the malicious objects in the response of events API.
• ScanOnGetObject: Optional. Enable this to scan the objects when you get them. For more details, see Scan on getObject request. (In preview)

  

• ScanResultTagFormat: The format of the scan result tags tagged on the scanned object. Select Separated tags to add each FSS tag as a standalone tag. Select Merged tag to add all FSS tags in one tag. Select No tag to disable the tagging feature. For more information, see View tags
• ScannerAWSAccount: Leave this field as-is. It is auto-populated with the name of the AWS account where the associated scanner stack is installed.
• ScannerSQSURL: Leave this field as-is. It is auto-populated with the full URL of the Simple Queue Service (SQS) used by the associated scanner stack.
• ScannerLambdaAliasARN: Leave this field as-is. It is auto-populated with the the ScannerLambda alias ARN of the associated scanner stack.
• KMSKeyARNForQueueSSE: Optional. Either leave this field empty or specify the ARN of the KMS master key used to encrypt messages in SQS queues if you have enabled server-side encryption. Use the same KMS master key that you used in the corresponding scanner stack.
• PermissionsBoundary: Optional. Provide the ARN of a policy that will be used to set the permissions boundary for all the roles that will be created. For more details, see AWS permissions control and Permissions boundaries for IAM entities.
• AdditionalIAMPolicies: Optional. Provide a list of IAM policy ARNs to attach to all the roles that will be created. For more details, see AWS permissions control.
• Resource prefixes: Optional. Either leave these fields empty or specify the prefix of each resource type. For details, see Resource prefixes.
• Storage stack dead-letter queue: Optional. Either leave these fields empty or specify the ARN of each resource. For details, see Storage stack dead-letter queue.
• Deploy in VPC: Optional. Either leave these fields empty or specify the VPC subnet IDs and the security group IDs. For details see Deploy in VPC.
• Stack package location: Leave this field as-is. It is for internal use by File Storage Security.
• Version: Leave this field as-is. It is for versioning.
• File Storage Security management account: Leave this field as-is. The account number is: 415485722356. You'll be granting this account permission to manage your storage stack. More specifically, this account has permission to:
  • Obtain the storage and scanner stacks' Lambda logs.
  • Update the ScannerLambda function, anti-malware pattern layers, and license layer in the stacks.
  • Send some of your organization's data to its own AWS SNS topic. For details on the data we collect, see our Data collection disclosure.
• Trend Micro Cloud One region: Leave this field as-is. It specifies the region to which the scanner and storage stacks will connect to for Cloud One services such as the File Storage Security console, event management services, and telemetry services. For more information, see Cloud One regions.
• ExternalID: Leave this field as-is. It is required for security purposes. For details, see Why do you need to use an external ID?
• At the bottom of the page, select the I acknowledge [...] check box.
• Select Create stack.

  

  The stack installs. The installation could take several minutes. You'll know when everything is deployed when you see the CREATE_COMPLETE message for the storage stack.

  

{
  "Sid": "Grant bucketListener permission",
  "Effect": "Allow",
  "Principal": {
    "AWS": <BucketListenerRoleARN>
  },
  "Action": [
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Resource": "*"
}

{
  "Sid": "Grant Scanner permission",
  "Effect": "Allow",
  "Principal": {
    "AWS": <ScannerExecutionRoleARN>
  },
  "Action": [
    "kms:Decrypt",
    "kms:GenerateDataKey"
  ],
  "Resource": "*"
}

• If this field is blank, add the ARN of the KMS Key used for SNS ScanResultTopic encryption
• If this field is not blank, append the ARN of the KMS Key to this filed as a comma-separated list of ARNs.

• Review your settings.
• Under Capabilities, select both I Acknowledge [...] check box(es).
• Select Update stack.

Note If you're a preview customer, the ScanningBucket that was included inside the storage stack is deleted.