Log Shipping

To set up the Log Pusher to S3, configure an AWS IAM Role to enable Qwilt to push logs to your Amazon S3 bucket, and then share the Role ARN value with Qwilt.

The following procedure provides step-by-step instructions on how to do this.

1. Log in to your AWS account. Choose All services and search for IAM. Open IAM.

2. In IAM, open the Roles page. Select Create role.

3. Under Trusted entity type, select Custom trust Policy. In the Custom trust policy field, paste the Trusted Policy you received from Qwilt. Below you can find the example to use.

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::052466545929:root"
       },
     "Action": "sts:AssumeRole"
   }
 ]
}

Click Next.

4. On the Add Permissions page, click Next without defining anything. On the Name, review, and create page, enter a Role name and then select Create role.

5. In the IAM Roles page, search for the new role you created and open it.

6. In the Permissions tab, select Add permissions, and then from the drop-down menu, select Create Inline Policy.

7. In the Specify permissions page, click the JSON button. In the Policy editor, enable the following actions:

“putObject”
“putObjectAcl”

We recommend specifying these actions as well, to facilitate troubleshooting if/when needed:

“getObject”
"getObjectAcl"
“listBucket”

Define as Resources the Arn of the S3 bucket you want to share with Qwilt (e.g., "arn:aws:s3:::qwilt_logs"), and specify all objects (e.g., "arn:aws:s3:::qwiltlogs/").

Example:

{
	"Version": "2012-10-17",
	"Statement": [
		{			"Effect":
"Allow",
			"Action": [
				"s3:PutObject",
				"s3:GetObjectAcl",
				"s3:GetObject",
				"s3:ListBucket",
				"s3:PutObjectAcl"
			],
			"Resource": [
				"arn:aws:s3:::qwilt_logs",
"arn:aws:s3:::qwilt_logs/*"
			]
		}
	]
}

8. Click Next.
9. Review the policy. Add a name to the policy that makes sense, and then select Create Policy.
10. In the Role page, under Summary, the Role ARN is displayed.

This ARN value needs to be shared with Qwilt in order to complete the setup.

Copy the value and share it with Qwilt, via a secure method of your choice.

To set up the Log Pusher to GCS, you will need to create a service account and assign it to your GCS bucket with the correct role, and then obtain and share the access object with Qwilt.

The following procedure provides step-by-step instructions on how to do this.

1. Create the Service Account. At this point you will not have to grant it with any permissions. Name the account and click Done.

2. Search for the desired bucket. In this example, the search was filtered for “mdl”.

3. Click the desired bucket, and then click the Permissions tab.

4. Assign the bucket with the relevant service account and then grant it with the Storage Object User role.

5. Your credentials will need to be shared with Qwilt in order to complete the setup. Secrets should be transferred over an encrypted channel (and received secrets will be kept encrypted). Your Qwilt representative will suggest the correct method for sharing your credentials.