Below is an example of an IAM policy you can use as a starting point to create your own IAM policy: For maximum security, the policy should limit access to S3 only via the Satori DAC IP addresses.

The IAM policy implemented by the Satori AWS user should be configured with access to any S3 bucket where data that requires control is stored. Perform the following steps to grant Satori access to AWS S3. To enforce security policies on data in S3, data must be queried via one of the supporting data stores such as AWS Athena, AWS Redshift Spectrum, Snowflake or others. Security policies and Masking Profiles are not supported on AWS S3 data stores. Note: Satori protects S3 data using Satori Datasets, Dataset Permissions, and Auditing.

Auditing user access to data in AWS S3 is performed via Satori, without requiring you to activate native AWS logging which does not differentiate between user and machine access.

There is no need to create an AWS IAM user for each data consumer, which reduces the risk of granting access to AWS resources that users do not require.

The benefits of this approach are as follows: Satori generates temporary credentials for data consumers instead of their existing AWS credentials. When using Satori to deliver access to data in AWS S3, organizations provision a single set of AWS credentials that are only used by the Satori DAC to access AWS S3. Satori reduces the risk of data leakage caused by misconfiguring users or permissions.

To gain access to the beta version, email us at streamlines and simplifies the process of controlling access to data in AWS S3. Support for AWS S3 is available in private beta for select customers.

Aws cyberduck