Integrating with Amazon Web Services (AWS) to Collect Evidence

You can set up Amazon Web Services (AWS) collectors to automatically collect evidence. Adding a collector will connect AWS with an evidence task so that evidence collection can begin. For information on managing your collector, see Managing Collectors.

This article covers the third-party systems listed below:

  • Amazon CloudTrail

  • Amazon CloudWatch

  • Amazon DynamoDB

  • Amazon EC2

  • Amazon IAM

  • Amazon Lambda

  • Amazon RDS

  • Amazon S3

  • Amazon VPC

To set up and activate collectors

Collectors are integration workflows that are set up to pull evidence from third-party systems. To integrate OneTrust with a third-party system, you must set up the credentials that OneTrust will use to connect to the system. You have the ability to create a new credential when setting up the collector.

  1. On the Compliance Automation menu, select Setup > Evidence Integrations.
    The Evidence Integrations screen appears.

  2. Click on the AWS system that will be set up to collect evidence.
    The Integration Details screen appears.
    Note:

    You can select any of the Amazon integrations.

  3. Click the Add Collector button.
    The Set Up Collector modal appears.

    Note:

    The collectors shown within this modal are unique to the services available for each third party system.

  4. Select the service that will collect evidence and click the Continue button.
  5. Complete the fields in the Add Details tab. For more information, see Add Details Screen Reference.
  6. Click the Continue button.
  7. Complete the fields in the Define Evidence Collection tab. For more information, see Define Evidence Collection Screen Reference.
  8. Click the Continue button.
  9. Review the information for the collector.

    Click the Previous button to edit the evidence collection details.

  10. Click the Activate Collector button to save and activate the collector. The collector's status will appear on the Integration Details screen. For information on managing your collector, see Managing Collectors.
    Note:

    This is the only location where you can activate the collector. This is to ensure the collector is not activated by mistake.



    Click the Cancel button to save the collector without activating it.

Add Details Screen Reference



Step

Field

Description

Add Details

Collector Name

Enter a unique and descriptive name for the collector that will be used to create the integration. This name will help you to identify the collector in future interactions.

Note:

Once you advance to the next screen, you cannot change the collector name.

Collector Assignee Email

Enter the email address that will receive notifications related to this collector. Create a distribution list if you would like to notify multiple users.

Email notifications are sent in the following situations:

  • The collector has been assigned to you and activated.

  • Evidence has been successfully captured.

  • Errors were found while capturing evidence automatically.

Choose Credentials

Select Credential

Select the existing credential you would like to use to share data securely. The collector will use credentials to access and gather data from the desired source.

You can create a new credential by clicking the Add new credential option. The Add new credential modal will appear.

Note:

You can also create a new credential in the Integrations menu. Once the new credential is created, it will appear as a saved credential. For more information, see Configuring Integration Credentials.

Credential Name

Enter a name to identify the credentials.

Note:

This field and all fields below only appears when you select the Add new credential option.

Description

Enter a description of the credentials.

AWS Access Key ID

Enter the AWS Access Key used to sign programmatic requests that you make to AWS. Access keys are long-term credentials for an IAM user or the AWS account root user.

Note:

If you do not have an access key, you can create one using the IAM console. For more information, see Access Requirements.

AWS Secret Key

Enter the AWS Secret Key used to sign programmatic requests that you make to AWS. The secret access key is available only at the time you create it.

Note:

If you do not have a secret access key, you can create one using the IAM console. For more information, see Access Requirements.

AWS Service Name

Enter the AWS service name in lowercase letters.

Note:

You can enter amazon dynamodb, amazon ec2, amazon lambda, or amazon s3.

Region

Enter the AWS Region. For a complete list of AWS Regions, see the Region Availability table in the Regions, Availability Zones, and Local Zones article.

Save Credential

Click the Save button to create the new credential and close the Add new credential modal.

Note:

If the credential is unable to collect evidence, you will need to select or create another credential.

Test Credential

Click the Test Credential button to test the credentials ability to collect evidence.

Define Evidence Collection Screen Reference



Step

Field

Description

Choose Evidence Tasks

Evidence Task List

Select one or more evidence tasks for this collector. You can filter the evidence tasks list by recommended, all evidence tasks, and selected tasks.

Assign Collection Intervals

Collection Interval

Select a collection interval to determine how often this collector will sync and collect evidence. The collection interval will apply to all selected evidence tasks.

Tip:

OneTrust recommends you choose the most frequent option.

For example, if the evidence tasks you selected have a frequency of Monthly, Quarterly, and Yearly - you should choose Monthly as your collection interval.

Time of Day

Select the time of day that evidence will be collected. All times are in UTC.

Day of the Week

Select the day of the week that evidence will be collected.

Note:

This option only appears if the Weekly collection interval is selected.

Day of the Month

Select the day of the month that evidence will be collected.

Note:

This option only appears if the Monthly, Quarterly or Biannually collection interval is selected.

Interval Start Month

Select the month when evidence will start being collected. This will set the cadence of evidence collection.

Note:

This option only appears if the Quarterly or Biannually collection interval is selected.

Date and Time of Day

Select the date and time that evidence will be collected. All times are in UTC.

Note:

This option only appears if the Yearly collection interval selected.

Access Requirements

You can create a new policy and users in the AWS Console to capture the Access Key ID and Secret Access Key needed to create credentials. AWS uses the security credentials to authenticate and authorize your requests.

To Create a New Policy

  1. Log into the AWS Management Console.



  2. Select IAM. The IAM Dashboard screen appears.

  3. On the IAM menu, select Access management > Policies. The Policies list screen appears.



  4. Click the Create policy button. The Specify permissions screen appears.

  5. Select JSON as the policy editor type.

  6. Download and copy the OneTrust AWS Policy.

    Note:

    The OneTrust AWS Policy provides the permissions that allows OneTrust to access your AWS environment and collect evidence to support security controls. The link to the OneTrust AWS Policy referenced in this step will take you to the Documentation Repo in myOneTrust where you can view and download the policy.

  7. Paste the OneTrust AWS Policy into the JSON policy editor.

  8. Click the Next button. The Review and create screen appears.

  9. Enter otaec-integration-policy in the Policy Name field.

  10. Scroll-down and click the Create policy button to create the new policy needed to capture the Access Key ID and Secret Access Key.

To Create a New User and Access Key

  1. On the IAM menu, select Access management > Users. The Users screen appears.



  2. Click the Create user button.

  3. Enter otaec-integration-user in the User name field.



  4. Click the Next button. The Set permissions screen appears.

  5. Select the Attach policies directly permission option.

  6. Search for the otaec-integration-policy.

  7. Click the checkbox next to the otaec-integration-policy.



  8. Click the Next button. The Review and create screen appears.

  9. Click the Create user button to create the new user needed to capture the Access Key ID and Secret Access Key.



  10. Click the View user button on the green banner. The otaec-integration-user screen appears.

  11. Click Create access key. The Access key best practices & alternatives screen appears.



  12. Select the Application running outside AWS use case.

  13. Click the Next button. The Set description tag - optional screen appears.

  14. Click the Create access key button. The Retrieve access keys screen appears.



  15. Copy the Access Key ID and Secret Access Key.