Set Up Access Summary Export

Private preview

The access summary export is currently in private preview and is available to select accounts. Contact your Immuta representative for details.

Use the following how-to to configure the access summary export to an S3 bucket. This export configuration requires access to your S3 bucket to add objects using one of the following authentication methods:

• Access and secret key

• AWS IAM role

Requirements:

• GOVERNANCE Immuta permission

• An S3 bucket you want to use to store the exported access summary.

How to export using an IAM user with access key

Configure your Immuta access summary to export to your S3 bucket and allow Immuta to authenticate using your AWS access key ID and secret access key. Here's a visual representation of the authentication flow:

1 - Configure an IAM user and policy

Access keys are tied to IAM users, which must be allowed to deposit objects in the target bucket via an attached IAM policy. Immuta requires that the user it authenticates as has the following permissions:

• s3:PutObject: Allows Immuta to upload objects to the bucket.

• s3:ListBucket: Allows Immuta to use ListObjectsV2.

If your S3 bucket is encrypted, the following permissions must also be granted to the role:

• kms:Decrypt: Allows Immuta to verify the integrity of the new data key before using it.

• kms:GenerateDataKey: Allows Immuta to generate a key that is used to encrypt the objects that are exported to S3 using your KMS key.

To begin, create an IAM user and attach a policy with the above permissions.

1. Follow AWS documentation to create a new user for Immuta to authenticate as and add objects to your S3 bucket.

2. Follow AWS documentation for creating IAM policies in the Amazon S3 console for the new policy.

   Here is an example IAM policy that contains the required permissions for a KMS encrypted bucket. If you are not using KMS encryption, you may omit the second statement. If you use this example, replace the content in angle brackets with the Amazon Resource Names (ARNs) for your S3 bucket and KMS key:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": "<your-s3-bucket-arn>/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "<your-kms-key-arn>"
        }
    ]
}

1. Follow AWS documentation to attach the policy to your newly created user.

2. Follow AWS documentation to generate the credentials that will be used to configure the export.

2 - Create an S3 bucket policy for the export

Before Immuta can export the access summary to your S3 bucket using your configured IAM user, you need to create a bucket policy that allows that IAM user to add objects to your specified S3 bucket. The following Amazon S3 action must be granted in the bucket policy:

• s3:PutObject: Allows Immuta to upload objects to the bucket.

To create the policy for the bucket, you must be the bucket owner.

1. Follow AWS documentation for adding a bucket policy in the Amazon S3 console.

2. Edit the JSON in the Policy section to include a bucket policy like the example below.

   In this example, the policy allows an IAM user (the principal) to add objects to the bucket. If you use this example, replace the content in angle brackets with the Amazon Resource Names (ARNs) for your IAM user and S3 bucket.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "<your-iam-user-arn>"
               },
               "Action": "s3:PutObject",
               "Resource": [
                   "arn:aws:s3:::<your-s3-bucket-arn>",
                   "arn:aws:s3:::<your-s3-bucket-arn>/*"
               ]
           }
       ]
   }

3. Save your changes.

Example policy

The example policy may block bucket access for other services, which then need to be configured via separate statements. Configure bucket policies with caution.

3 - Configure the access summary export to S3

1. Generate an Immuta API key on your profile page.

2. Make the following API call to the Immuta API:

curl 'https://<your.immuta.url>/access-summary/export-config' \
  -X POST \
  -H 'Authorization: Bearer <your API key>' \
  -H 'Content-type: application/json' \
  --data-raw '{"bucket": "<bucket name>","region": "<region>","accessKeyId":"<REDACTED>","secretAccessKey":"<REDACTED>","path": "<path>"}'

• your Immuta URL: The URL of your Immuta Govern app.

• bucket name: Name of the bucket your access summary will be sent to that you added the policy to above.

• region: AWS region (such as "us-east-1").

• accessKeyId: AWS access key ID for authentication. See the AWS documentation for information about using an access key ID and secret access key.

• secretAccessKey: AWS secret access key for authentication.

• path: The name of the folder within the bucket to put the access summary in. This field is optional.

4 - Verify the export configuration connection

If the configuration is successful, you will see the access summary export at 3AM local time.

How to export using an AWS IAM role

Configure your Immuta access summary to export to your S3 bucket and allow Immuta to authenticate using an AWS role. With this option, you provide Immuta with an IAM role from your AWS account that is granted a trust relationship with Immuta’s IAM role for adding objects to your S3 bucket. Immuta will assume this IAM role from Immuta’s AWS account in order to perform operations in your AWS account. Here's a visual representation of the authentication flow:

Immuta requires a role with the following allowed action to the S3 bucket you want the access summary exported to:

• s3:PutObject which allows the role to add an object to a bucket.

• s3:ListBucket: Allows Immuta to use ListObjectsV2.

If your S3 bucket is encrypted, the following permissions must also be granted to the role:

• kms:Decrypt: Allows Immuta to verify the integrity of the new data key before using it.

• kms:GenerateDataKey: Allows Immuta to generate a key that is used to encrypt the objects that are exported to S3 using your KMS key.

1 - Configure an IAM role and policy

1. Follow AWS documentation to create a new role for Immuta to assume and add objects to your S3 bucket.

2. Follow AWS documentation for creating IAM policies in the Amazon S3 console for the new role.

   Here is an example IAM Policy that contains the required permissions for a KMS encrypted bucket. If you are not using KMS encryption, you may omit the second statement. If you use this example, replace the content in angle brackets with the Amazon Resource Names (ARNs) for your S3 bucket and KMS key:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": "<your-s3-bucket-arn>/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:GenerateDataKey"
            ],
            "Resource": "<your-kms-key-arn>"
        }
    ]
}

1. Follow AWS documentation to attach the policy to your newly created role.

2 - Create an S3 bucket policy for the export

Before Immuta can export the access summary to your S3 bucket using your configured IAM role, you need to create a bucket policy that allows that IAM role to add objects to your specified S3 bucket. The following Amazon S3 action must be granted in the bucket policy:

• s3:PutObject: Allows Immuta to upload objects to the bucket.

To create the policy for the bucket, you must be the bucket owner.

1. Follow AWS documentation for adding a bucket policy in the Amazon S3 console.

2. Edit the JSON in the Policy section to include a bucket policy like the example below.

   In this example, the policy allows an IAM user (the principal) to add objects to the bucket.

   If you use this example, replace the content in angle brackets with the Amazon Resource Names (ARNs) for your IAM role and S3 bucket.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "<your-iam-role-arn>"
               },
               "Action": "s3:PutObject",
               "Resource": [
                   "arn:aws:s3:::<your-s3-bucket-arn>",
                   "arn:aws:s3:::<your-s3-bucket-arn>/*"
               ]
           }
       ]
   }

3. Save your changes.

Example policy

The example policy may block bucket access for other services, which then need to be configured via separate statements. Configure bucket policies with caution.

3 - Create a trust relationship and assume role policy

Follow AWS documentation for creating IAM trust relationships and assume role polices in the Amazon IAM console. Use the example JSON below to create a trust policy between Immuta and your AWS bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::475806706894:root"
            },
            "Action": "sts:AssumeRole",
            "Condition": {"StringEquals": {"sts:ExternalId": "<tenant ID>"}}
        }
    ]
}

External ID: Use your <tenant ID> as the external ID.

To retrieve your tenant ID:

1. Navigate to this URL: https://[your.immuta.url]/deployment/tenant

2. Use the id value from the response. That is your tenant ID.

For example:

"Condition": {"StringEquals": {"sts:ExternalId": "a9b28d9e-8e09-4735-bdb1-2f44ddbd4801"}}

4 - Configure the access summary export to S3

1. Generate an Immuta API key on your profile page.

2. Make the following API call to the Immuta API:

curl 'https://<your.immuta.url>/access-summary/export-config' \
  -X POST \
  -H 'Authorization: Bearer <your API key>' \
  -H 'Content-type: application/json' \
  --data-raw '{"bucket": "<bucket name>","region": "<region>","roleArn": "<IAM role>","path": "<path>"}'

• your Immuta URL: The URL of your Immuta Govern app.

• bucket name: Name of the bucket your access summary will be sent to that you added the policy to above.

• region: Your AWS region (such as "us-east-1").

• roleArn: AWS role ARN for authentication that you added the policies to above. Immuta will assume this role when exporting the access summary to S3.

• path: The name of the folder within the bucket to put the access summary in.

5 - Verify the export configuration connection

Now that the configuration and the trust relationship have been created, you will see the access summary export at 5 AM local time.