Skip to main content
Go to Red Canary Documentation
Red Canary Support

Integrate Multiple AWS Orgs or Standalone Accounts Using One Consolidated S3 Bucket

  • Updated .

Issue

User wants to integrate multiple AWS accounts with Red Canary by centralizing logs into a single S3 bucket using prefixes, but those accounts are not part of the same AWS Organization.  Is it possible to integrate the independent accounts or multiple AWS Organizations using this configuration?

Environment

Standalone AWS accounts or multiple AWS Organizations

Resolution

At this time, it is not possible integrate multiple AWS Organizations or standalone accounts using data consolidated to a single S3 bucket in one account.  You will need to create an S3 bucket under each separate Organization or standalone account, then create a corresponding integration in Red Canary for each scope.  See examples below for next steps.

  • All accounts are in a single AWS Organization:  Create a single AWS integration in Red Canary using the Organization-level scope
  • Accounts are split between multiple AWS Organizations:  Create as many Org-level AWS integrations in Red Canary as there are AWS Organizations
  • Mix of standalone AWS accounts and one or more AWS Organizations:  Create as many Org-level AWS integrations in Red Canary as there are AWS Organizations.  Any standalone accounts outside of these Orgs will each need their own integration in Red Canary at the account-level scope
  • All AWS accounts are standalone and not part of an AWS Organization:  Create as many AWS integrations in Red Canary at the account-level scope as there are AWS accounts to integrate
For each scenario described above, all AWS infrastructure (S3 bucket, SNS topic, KMS keys, etc.) used in your Red Canary config must exist solely within the scope of the integration.

For example, you cannot configure an integration for AWS Org A using an S3 bucket that belongs to AWS Org B or a standalone AWS account.  The S3 bucket must reside in an account under AWS Org A.  Even if logs from AWS Org B or standalone AWS accounts are sent to this S3 bucket, the data will be dropped by Red Canary because the integration is expecting logs from AWS Org A only.

Cause

Red Canary's AWS integration is designed to parse data for the specific ID listed in the integration.  Data that does not belong to the integrated Org ID (when integrated at the Org scope) or Account ID (when integrated at the Account scope) is dropped.