--- title: "Authorize SQS data access" canonical: "https://docs.devo.com/space/latest/1098121229/Authorize%20SQS%20data%20access" format: markdown --- > Macro (toc) ## Purpose To **use Devo to secure your AWS data**, **you need to ****[authorize](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction_access-management.html)**** Devo to receive the information. ** After completing these steps, you will have an **S3 Bucket**, **SQS**, **SQS Access Policy**, **IAM Policy**, **Role**, and **Trust Policy** in your AWS account. Data will be available to Devo and your policies will follow AWS recommended best practices. ## Permissions AWS account [permissions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html) required to follow these instructions: ## Authorize it ### Create an Information List 1. **Create a list** of this information. 1. **[AWS Partition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html)****.** For example, `aws`. 2. **[AWS Region](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Concepts.RegionsAndAvailabilityZones.html)****.** For example, `us-east-1`. 3. **Your AWS Account.** For example, `012345678901`. 4. **S3 Principal Service endpoint**. This is almost always `s3.amazonaws.com` but [GovCloud FIPS](https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-s3.html) is a known exception. 5. **[S3 bucket name](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html?icmpid=docs_amazons3_console)****.** You can make one up, such as `BucketCloudTrailDevo` if you are authorizing access to CloudTrail data. 6. **SQS name.** You can make one up, such as `SQSCloudTrailDevo`. 7. **IAM policy name.** Make this the same as the SQS name. 8. **Role name.** Make this the same as the SQS name. 9. **External ID.** The external ID configured in AWS. 10. **Collector name.** You can make one up. If your Devo domain is `child@parent`, the collector name could be `child-parent-sqs-CloudTrailDevo`. ### Create S3 Bucket 2. **Create an S3 bucket using the default settings.** Use a separate bucket for each log format, if possible. ![image-20250111-030448.png](media://2ceb5549-5025-4176-bc35-179b348d80f6) ### Create SQS 3. **Create a standard SQS queue** named `devo_deadletter_queue`. Use the default settings. ![Screenshot 2025-01-10 at 22.09.41.png](media://be16b040-c572-4c9f-ae15-f97403db89cd) 4. **Create a second standard SQS queue **using your queue name. This will be the queue used to send data to Devo. 5. Select the **maximum retention period.** ### Set SQS Access Policy 6. Set the following **SQS access ****[policy](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-overview-of-managing-access.html)**, replacing the [values](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html) enclosed in `< >`. ![image-20250129-210751.png](media://5a73cf95-7ac9-4daf-b32c-5b92d57aa81e) ``` { "Version": "2012-10-17", "Id": "", "Statement": [ { "Sid": "AllowS3toSendMessages", "Effect": "Allow", "Principal": { "Service": "" }, "Action": [ "SQS:SendMessage" ], "Resource": "arn::sqs:::", "Condition": { "ArnLike": { "aws:SourceArn": "arn::s3:*:*:" }, "StringEquals": { "aws:SourceAccount": "" } } } ] } ``` An example resource is `arn:aws:sqs:us-east-1:0123456789:devologs`. 7. **Enable the dead-letter queue **named `devo_deadletter_queue`. 8. **Keep the defaults** for the other SQS settings. 9. **Return to the S3 Bucket Propertie**s. 10. Select **“Create event notification.”** 11. Enable **“All object create events.“** 12. Select the **SQS queue**. ### IAM Policy 14. **Create an ****[IAM Policy](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create-console.html)****.** ![image-20250111-034338.png](media://b064b075-233d-4427-991a-b1701b428cfd) 15. **Add this JSON ****[Policy](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-policies.html)****.** ![image-20250129-210859.png](media://29e52d4c-1c4f-4b98-aa8b-5a5c69797fd3) ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "s3:GetObject", "sqs:DeleteMessage", "sqs:GetQueueAttributes", "sqs:ChangeMessageVisibility", "sqs:ReceiveMessage" ], "Resource": [ "arn::sqs:::", "arn::s3:::/*" ] } ] } ``` 16. Click `Next`. 17. **Name **the policy. 18. **Create **the policy. ### Role 19. **Create a ****[role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html)****.** ![image-20250113-021110.png](media://4d6d522f-711d-43f8-87c8-922a25cc6cbe) ### Select Trust Policy 20. Select ***Custom trust policy****.* ![image-20250129-210920.png](media://846740f3-ae18-4386-95e2-88bafa991b6f) 21. **Set** the trust policy. a. If your partition is `aws`: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::476382791543:role/devo-xaccount-cc" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` b. If your partition is `aws-us-gov`: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws-us-gov:iam::210253767148:role/devo-xaccount-cc" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` 22. **Add the permissions **to the role by selecting the IAM policy that you already created. ![image-20250129-210936.png](media://91ac7c9d-be9a-4461-8afd-f7b0a7fa3449) 23. **Name** the role. ![image-20250115-183841.png](media://d59b0a77-892a-40e2-ab59-d571b02712e4) Once the authorization process is complete, you can **[enable a Devo collector](https://devodocs.atlassian.net/wiki/spaces/latest/pages/653623299)**** and add data to the S3 Bucket.** ## Validate the Authorization If there is no data being delivered to the S3 bucket yet and the collector is running, you may **validate authorization by uploading an empty file to the bucket.** In `devo.collectors.out` the collector will log > Number of messages in the queue: 0 and Number of messages in flight 1 followed by > the file size is 0 Bytes and has 1 to process indicating correct authorization.