Protect Service Installation

Protect Service Installation

The following sections install the Cloud Protect serverless Lambda function.

Preparation

Ensure that all the steps in Pre-Configuration are performed.

1. Login to the AWS account console where Protegrity Serverless will be installed.

2. Ensure that the required CloudFormation templates provided by Protegrity are available on your local computer.

Create Protect Lambda IAM Execution Policy

This task defines a policy used by the Protegrity Lambda function to write CloudWatch logs and access the KMS encryption key to decrypt the policy.

Perform the following steps to create the Lambda execution role and required policies:

1. From the AWS IAM console, select Policies > Create Policy.

2. Select the JSON tab and copy the following sample policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Sid": "CloudWatchWriteLogs",
         "Effect": "Allow",
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents"
         ],
         "Resource": "*"
       },
       {
         "Sid": "KmsDecrypt",
         "Effect": "Allow",
         "Action": [
           "kms:Decrypt"
         ],
         "Resource": [
           "arn:aws:kms:*:*:key/*"
         ]
       }
     ]
   }
   

3. For the KMS policy, replace the Resource with the ARN for the KMS key created in a previous step.

4. Select Next, type in a policy name, for example, ProtegrityProtectLambdaPolicy and Create Policy. Record the policy name:

   ProtectLambdaPolicyName:__________________

Create Protect Lambda IAM Role

The following steps create the role to utilize the policy defined in Create Protect Lambda IAM Execution Policy.

To create protect lambda IAM execution role:

1. From the AWS IAM console, select Roles > Create Role.

2. Select AWS Service > Lambda > Next.

3. In the list, search and select the policy created in Create Protect Lambda IAM Execution Policy.

4. Click Next

5. Type the role name, for example, ProtegrityProtectRole

6. Click Create role

7. Record the role ARN.

   Role ARN (LambdaExecutionRoleArn): ___________________

Install using CloudFormation

The following steps describe the deployment of the Lambda function.

• Access CloudFormation and select the target AWS Region in the console.

• Click Create Stack and choose With new resources.

• In Specify template section select Upload a template file.

• Click Choose file to upload the Protegrity-provided CloudFormation template called pty_athena_protect_cf.json and click Next.

• Specify stack details. Enter stack name.

  Note

  The stack name will be appended to all the services created by the template.

• Enter the required parameters. All the values were generated in the pre-configuration steps.

  Parameter	Description
  ArtifactS3Bucket	Name of S3 bucket created in the pre-configuration step
  LambdaExecutionRoleArn	The ARN of Lambda role created in the prior step
  PolicyUser	Name of the Policy User that will be passed as an environment variable to the lambda function. With protegrity-sample-policy-<version>.zip, you can set this value to policyuser.
  PolicyUserConfig	The settings for POLICY_USER_CONFIG. Default Value: 0, Values: [0,1,2]. Note See Policy User for information on POLICY_USER_CONFIG.
  UsernameRegex	The settings for USERNAME_REGEX. Default Value: Not Set, Values: “1” or regex expression. Note See Policy User and Configuring Regular Expression to Extract Policy Username for information on USERNAME_REGEX.
  MinLogLevel	Minimum log level for protect function. Allowed Values: off, severe, warning, info, config, all

• The log forwarder parameters can be provided later after log forwarder is deployed. If you are not planning to deploy log forwarder you can skip this step.

  Log Forwarder Parameters	Description
  KinesisLogStreamArn	The ARN of the AWS Kinesis stream where audit logs will be sent for aggregation
  AuditLogFlushInterval	Time interval used to accumulate audit logs before sending to Kinesis

• Proceed to the last step of the Create Stack wizard with defaults and click Submit to create CloudFormation stack.

• After CloudFormation is completed, select the Outputs tab in the stack. Record the following values:

  ProtectFunctionName: __________________________

  ProtectFunctionProductionAlias: __________________________

  ProtectLayerName: _____________________________

Test Connectivity

Perform the following steps to verify Athena is working correctly with Protegrity.

• Access the Athena console.

• Copy and paste the following snippet into a worksheet.

  USING EXTERNAL FUNCTION unprotect(val varchar, el varchar) RETURNS varchar 
       LAMBDA '<replace_with_athena_protect_function_name>:Production'
  SELECT unprotect('UtfVk UHgcD!', 'alpha')
  

• Replace the placeholder value with the lambda function name

• Run the above Query

• Verify that the string hello world! is returned.

Troubleshooting Tips

What’s Next

• Install Policy Agent