{
  "name": "AwsS3ServerAccessLogsDefinition",
  "apiVersion": "2024-09-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "AwsS3ServerAccessLogsDefinition",
      "title": "AWS S3 Server Access Logs (via Codeless Connector Framework)",
      "logo": "amazon_web_services_Logo.svg",
      "publisher": "Microsoft",
      "providerDisplayName": "Amazon Web Services",
      "descriptionMarkdown": "This connector allows you to ingest AWS S3 Server Access Logs into Microsoft Sentinel. These logs contain detailed records for requests made to S3 buckets, including the type of request, resource accessed, requester information, and response details. These logs are useful for analyzing access patterns, debugging issues, and ensuring security compliance.",
      "graphQueriesTableName": "AWSS3ServerAccess",
      "graphQueries": [
        {
          "metricName": "Total events received",
          "legend": "AWS S3 Server Access Logs",
          "baseQuery": "{{graphQueriesTableName}}"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get Sample of logs",
          "query": "{{graphQueriesTableName}}\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "{{graphQueriesTableName}}",
          "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize LastReceived = max(TimeGenerated)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors",
          "value": null
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "providerDisplayName": "Workspace",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true,
              "action": false
            }
          },
          {
            "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
            "permissionsDisplayText": "Read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key)",
            "providerDisplayName": "Keys",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": false,
              "write": false,
              "delete": false,
              "action": true
            }
          }
        ],
        "customs": [
          {
            "name": "Environment",
            "description": "You must have the following AWS resources defined and configured: S3 Bucket, Simple Queue Service (SQS), IAM roles and permissions policies."
          }
        ]
      },
      "instructionSteps": [
        {
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "### 1. AWS CloudFormation Deployment \n To configure access on AWS, two templates has been generated to set up the AWS environment to send logs from an AWS S3 Server Access logs to your Log Analytics Workspace.\n"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "#### Deploy CloudFormation Templates in AWS: \n1. Navigate to the [AWS CloudFormation Stacks](https://aka.ms/awsCloudFormationLink#/stacks/create).\n2. Click **Create stack** and select **With new resources**.\n3. Choose **Upload a template file**, then click **Choose file** to upload the appropriate CloudFormation template provided.\n4. Follow the prompts and click **Next** to complete the stack creation.\n5. After the stacks are created, note down the **Role ARN** and **SQS Queue URL**.\n"
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 1: OpenID Connect authentication provider deployment",
                "isMultiLine": true,
                "fillWith": [
                  "Oidc"
                ]
              }
            },
            {
              "type": "CopyableLabel",
              "parameters": {
                "label": "Template 2: AWS Server Access resources deployment",
                "isMultiLine": true,
                "fillWith": [
                  "AWSS3ServerAccess"
                ]
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "### 2. Connect new collectors \n To enable AWS S3 Server Access Logs Connector for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnValue": "properties.roleArn",
                    "columnName": "Role ARN"
                  },
                  {
                    "columnValue": "properties.sqsUrls[0]",
                    "columnName": "Queue URL"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "contextPaneType": "DataConnectorsContextPane",
                "title": "Add new collector",
                "subtitle": "AWS Server Access Logs connector",
                "label": "Add new collector",
                "instructionSteps": [
                  {
                    "title": "Account details",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Role ARN",
                          "type": "text",
                          "name": "roleArn",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Queue URL",
                          "type": "text",
                          "name": "queueUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}