Prerequisites

Lambda

Provides serverless compute for Protegrity protection operations and the ESA integration to fetch policy updates or deliver audit logs.

API Gateway

Provides the endpoint and access control.

KMS

Provides secrets for envelope policy encryption/decryption for Protegrity.

Secrets Manager

Provides secrets management for the ESA credentials .

S3

Intermediate storage location for the encrypted ESA policy layer.

Kinesis

Required if Log Forwarder is to be deployed. Amazon Kinesis is used to batch audit logs sent from protector function to ESA.

VPC & NAT Gateway

Optional. Provides a private subnet to communicate with an on-prem ESA.

CloudWatch

Application and audit logs, performance monitoring, and alerts. Scheduling for the policy agent.

Yes

Protector was designed to work with this ESA version

No

Protector will not work with this ESA version

*

Backward compatible policy download supported:

• Data elements and features which are common between this and previous ESA versions will be downloaded
• Data elements and features which are new to this ESA version and do not exist in previous ESA version will not be downloaded

Protegrity distribution and installation scripts

These artifacts are provided by Protegrity

Protegrity ESA 10.0+

The Cloud VPC must be able to obtain network access to the ESA

AWS Account

Recommend creating a new sub-account for Protegrity Serverless

AWS Account Administrator

To run CloudFormation (or perform steps manually), create/configure a VPC and IAM permissions.

Protegrity Administrator

The ESA credentials required to extract the policy for the Policy Agent

Network Administrator

To open firewall to access ESA and evaluate AWS network setup