--- title: "Integrate Amazon Web Services (AWS) with Zscaler MDR - LEGACY" slug: "integrate-amazon-web-services-aws-with-zscaler-mdr" updated: 2026-09-10T19:39:58Z published: 2026-09-10T19:39:58Z canonical: "docs.redcanary.com/integrate-amazon-web-services-aws-with-zscaler-mdr" excludeFromSearch: true --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt > Use this file to discover all available pages before exploring further. # Integrate Amazon Web Services (AWS) with Zscaler MDR - LEGACY > [!NOTE] > LEGACY VERSION > > A newer version of the Zscaler MDR AWS integration is now available. Please see [this page](/doc/docs/integrate-amazon-web-services-with-zscaler-mdr) for details. Integrating Amazon Web Services (AWS) with Zscaler MDR enhances security operations by centralizing monitoring, enabling effective threat detection and response, facilitating automated actions, and improving overall cloud security. To integrate AWS with Zscaler MDR, follow the procedure below from beginning to end. After all steps are successfully completed, data should be successfully ingested into Zscaler MDR after ~20 minutes. > [!WARNING] > Account Limits > > Zscaler MDR restricts all cloud integrations to 2,000 accounts or external services in a single subdomain. Please contact your Customer Success Manager if you anticipate hitting this limit. ## **Prerequisites** - You must have AWS permissions to: - Create Simple Notification Service (SNS) topics - Create IAM roles - Adjust resource policies on SNS topics - Set notifications on S3 bucket - Adjust resource policies on S3 buckets - Adjust resource policies on KMS keys - Existing infrastructure: - AWS CloudTrail storing logs in an S3 bucket - Your AWS account ID. For more information, see [Finding your AWS account ID](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html#:~:text=that%20you%20have.-,Find%20your%20AWS%20account%20ID,-You%20can%20find) - ACLs are disabled on the S3 bucket containing the CloudTrail logs (recommended by Amazon). For more information, see [Disabling ACLs](https://aws.amazon.com/blogs/storage/disabling-acls-for-existing-amazon-s3-workloads-with-information-in-s3-server-access-logs-and-aws-cloudtrail/#:~:text=disable%20ACLs.-,Step%205%3A%20Disable%20ACLs,-Now%20that%20ACL). ## **Step 1: Choose the scope of your integration** As an AWS user you can select an organization or account when integrating with Zscaler MDR. If your AWS accounts are organized under an AWS organization, it is easier to add a single Zscaler MDR integration for the organization than a separate integration for each AWS account. 1. In the Zscaler MDR portal, click **Integrations**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(26).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. From the Integrations section, locate and then click **Amazon Web Services**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(27).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Enter a name for your new AWS integration. 4. Choose the scope of your integration by selecting either **Organization** or **Account**. **Organization** - Configure the integration to scan your AWS organization and its member accounts. **Account** - Configure the integration to scan a single AWS account. > [!NOTE] > Note: If you select Account, [click here to continue the Account integration process](/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#:~:text=click%20Next.-,Account%20(Zscaler%20MDR/AWS),-If%20you%20selected). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(97b).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) ### Organization (Zscaler MDR/AWS) 1. If you select Organization, enter your **Organization ID**. 1. To locate your Organization ID, navigate to AWS and then search for **Organizations**. 2. Click **Organizations**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(98).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. Copy, and then paste the organization ID into Zscaler MDR. 3. Enter any Excluded Accounts; this step is optional. 1. > **Note**: Excluded Accounts is a comma separated list of account ID(s) that will be excluded from the Zscaler MDR scan. Additionally, Zscaler MDR will not process excluded account data for CloudTrail, GuardDuty, and billable resources. 4. From Zscaler MDR, click **Next**. ### Account (Zscaler MDR/AWS) 1. If you selected **Account**, enter your **Account ID**. For more information, see [Finding your AWS account ID](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html#:~:text=that%20you%20have.-,Finding%20your%20AWS%20account%20ID,-You%20can%20find). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(100b).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. From Zscaler MDR, click **Next**. ## **Step 2: Identify the S3 bucket containing CloudTrail logs and SNS Topic** Zscaler MDR will read CloudTrail logs from an S3 bucket. If CloudTrail already logs to an S3 bucket, Zscaler MDR can utilize an existing S3 bucket. Once the SNS topic and SQS queues are functional, Zscaler MDR needs to be able to copy the data from your S3 bucket into our ingestion bucket. > [!NOTE] > Note: Creating a new CloudTrail for Zscaler MDR could increase your AWS bill. To avoid increased costs, we recommend using your pre-existing CloudTrail. For new CloudTrail users, your first CloudTrail is free. For more information, see [Managing CloudTrail trail costs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-trail-manage-costs.html). ### Locate the ARN of the S3 Bucket 1. To locate your S3 Bucket ARN, navigate to AWS and then search for **CloudTrail**. 2. Click **CloudTrail**. 3. Click on the active Trail name. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(32).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 4. Click the **Trail log location**. 5. From the breadcrumbs section, click the CloudTrail location. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(33).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 6. Click the **Properties** tab. 7. Copy and then paste the ARN of the S3 bucket containing the CloudTrail logs into Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(34).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(35).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) ### Locate/Create an SNS Topic for CloudTrail Logging bucket notifications 1. To create your S3 Bucket ARN, navigate to AWS and then search for **Simple Notification Service**. 2. Click **Simple Notification Service**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(205).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Enter a name for your new SNS topic. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(206).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 4. Click **Create Topic**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(36).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. Copy and save the SNS Topic ARN. You’ll use this in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(37).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 6. Click **Edit**. 7. From the Access Policy section, copy and then enter the code below: > [!NOTE] > To get the Zscaler MDR ARN from the Zscaler MDR Integration Setup page: > > 1. Click on **Sample SNS access policy statement** under Step 3b. > 2. Copy the ARN provided next to “AWS”: ```plaintext {                      "Version": "2008-10-17",                      "Id": "__default_policy_ID",                      "Statement": [                        {                          "Sid": "RCPartnerAccessControl",                          "Effect": "Allow",                          "Principal": {                            "AWS": ""                          },                          "Action": "SNS:Subscribe",                          "Resource": ""                        },                        {                          "Sid": "__default_statement_ID",                          "Effect": "Allow",                          "Principal": {                            "AWS": "*"                          },                          "Action": [                            "SNS:Publish",                            "SNS:RemovePermission",                            "SNS:SetTopicAttributes",                            "SNS:DeleteTopic",                            "SNS:ListSubscriptionsByTopic",                            "SNS:GetTopicAttributes",                            "SNS:AddPermission",                            "SNS:Subscribe"                          ],                          "Resource": "INSERT SNS TOPIC ARN HERE",                          "Condition": {                            "StringEquals": {                              "AWS:SourceArn": ""                            }                          }                        }                      ]                    } ``` > **Note**: If you have an existing SNS Topic in AWS, ensure that your Access Policy update for the integration contains the code below. 1. Within the Access Policy section, ensure that the Resource line contains the SNS Topic ARN. Additionally, change **AWS:SourceOwner** to **AWS:SourceArn** and then paste your S3 bucket ARN. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(207).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) Your access policy should look like the image below. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(208).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. From Zscaler MDR, enter the SNS topic ARN from [Step 2.5](https://redcanary.document360.io/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#:~:text=Copy%20and%20save%20the%20SNS%20Topic%20ARN.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(38).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Click **Next**. ### Push notifications to your SNS topic from an S3 bucket When data is put into an S3 bucket, messages can be pushed onto your SNS topic. SNS can then push notifications to any subscriber including the Zscaler MDR SQS queue. **AWS** 1. From the AWS homepage, type and select **S3** in the search bar. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(149).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. Click the AWS bucket you want to use to send data to Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(150).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Click the **Properties** tab. 4. Scroll down to the Event notifications section, and then click **Create event notification**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(151).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. Enter an Event name for your event notification. 6. From the Event types section, select **All object create events**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(152).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 7. From the Destination section, select **SNS topic**. 8. From the SNS topic dropdown, select the SNS topic you updated in [the previous section](https://redcanary.document360.io/doc/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#locatecreate-an-sns-topic-for-cloudtrail-logging-bucket-notifications:~:text=into%20Zscaler%20MDR.-,Locate/Create%20an%20SNS%20Topic%20for%20CloudTrail%20Logging%20bucket%20notifications%C2%A0,-To%20create%20your). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(154).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 9. Click **Save Changes**. > **Note**: Upon successful setup of the SNS topic, the topic should populate with two subscriptions (generally within 15 minutes). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(269).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) ## **Step 3: Grant Zscaler MDR permission to ingest CloudTrail logs** Enable Zscaler MDR to decrypt your AWS CloudTrail data in order to start sending alerts to Zscaler MDR. #### **S3 bucket** 1. To grant the required S3 bucket access, navigate to AWS. Type and then select CloudTrail in the search bar. 2. Click the **Trail** that you want Zscaler MDR to have access to. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(43).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Click the **Trail log** **location**. 4. From the breadcrumbs section, click the **CloudTrail location**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(44).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. Click the **Permissions** tab. 6. From the Bucket Policy section, click **Edit**. #### **Zscaler MDR** 7. On Step 3a of the integration setup in Zscaler MDR, click and open the **Sample S3 bucket policy statement** dropdown. Copy and then paste the following code into your existing Policy: > [!NOTE] > Note: You must replace the sample Resource ARN in the Zscaler MDR provided code with your own personal Resource ARN. #### ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(287).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 8. From the Resource line (highlighted above), enter the ARN of the S3 Bucket from [Step 2.5](https://redcanary.document360.io/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#:~:text=Copy%20and%20save%20the%20SNS%20Topic%20ARN.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.). #### S3 Bucket 9. Click **Save Changes**. #### **KMS** 1. To grant the required KMS access, navigate to AWS. Type and then select **CloudTrail** in the search bar. 2. Click the **Trail** that you want Zscaler MDR to have access to. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(45).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. Click the **AWS KMS key**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(46).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 4. Copy and save the **AWS KMS ARN** address. You will use this in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(47).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. Scroll down to the Key Policy section. #### Zscaler MDR 6. Click and open the **Sample KMS key policy statement** dropdown. Copy the code shown: #### ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(42).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) AWS 7. Paste the code into the Key Policy editor: ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(270).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) > Note: “Resource”: “*” refers to this KMS key only. Refer to [Key Policy Elements](https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-overview.html#key-policy-elements) for more information. 8. Click **Save Changes**. #### Zscaler MDR 1. Select and grant Zscaler MDR access to the following by selecting the checkboxes next to each: - S3 Bucket - SNS topic - KMS ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(290).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. From Zscaler MDR, click **Next**. ## **Step 4: Provision an IAM role in the account(s) being configured** Use a Zscaler MDR provided template to provision an IAM role in your environment for Zscaler MDR access. 1. To use one of the provided templates to provision an IAM role in your environment for Zscaler MDR access, click **CloudFormation** or **Terraform** to access the appropriate template. 2. Copy and paste your required template into a new file/document. Save this new file with your template. You’ll upload this file to AWS in a later step. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(49).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 3. To provision an IAM role, navigate to AWS. 4. Apply the **CloudFormation** or **Terraform** template to all accounts in the AWS organization. > **Note**: Using Terraform is dependent on your environment and we are not able to replicate the necessary steps at this time. ### For CloudFormation Stack (Account) a. Type and then select **CloudFormation** in the search bar. b. Click the **Create stack** dropdown, and then click **With new resources (standard)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(182).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) c. From the Prerequisite section, select **Choose an existing template**. d. From the Specify template section, select **Upload template file**. e. Click **Choose file**, and then select the file created in [Step 4.2](https://redcanary.document360.io/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#:~:text=Copy%20and%20paste%20your%20required%20template%20into%20a%20new%20file/document.%20Save%20this%20new%20file%20with%20your%20template.%20You%E2%80%99ll%20upload%20this%20file%20to%20AWS%20in%20a%20later%20step.). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(183).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) f. Click **Next**. g. Enter a name for your new Stack.From AWS, type and then select **CloudFormation** in the search bar. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(184).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) h. Click **Next**. i. Click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(185).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) j. From the Capabilities section, select the **acknowledgment message**. k. Click **Submit**. l. From the Search bar, type and then select **IAM** in the search bar. m. Click **Roles**. n. Select the stack you created in this step, and then copy the ARN for this role. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(186).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) o. Paste the ARN of the IAM Role into Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(188).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 5. From the Advanced Configuration section, Ingest GuardDuty Finding is selected by default. If you do not want Zscaler MDR to ingest this type of data, deselect **Ingest GuardDuty Finding**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(181).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) > **Note**: In order for Zscaler MDR to have access to context, analysis, and improved insight into potential risks in your security environment, we recommend that you leave **Ingest GuardDuty Finding** enabled. 1. Click **Save**. ### StackSet (Organization) a. From AWS, type and then select **CloudFormation** in the search bar. b. Click **StackSets** in the navigation pane. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(189).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) c. Click **Create StackSet**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(190).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) d. Enter a name for your IAM role. **Note**: We suggest using the name **rc-partner-access-control**. e. From the Prerequisite section, select **Template is ready**. f. From the Specify template section, select **Upload template file**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(191).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) g. Click **Choose file**, and then select the file created in [Step 4.2](https://redcanary.document360.io/docs/integrate-amazon-web-services-aws-with-zscaler-mdr#:~:text=Copy%20and%20paste%20your%20required%20template%20into%20a%20new%20file/document.%20Save%20this%20new%20file%20with%20your%20template.%20You%E2%80%99ll%20upload%20this%20file%20to%20AWS%20in%20a%20later%20step.). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(192).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) h. Click **Next**. i. Enter a name for your new Stack. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(194).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) j. Click **Next**. k. Click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(195).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) l. From the Specify regions section, select the region you want to deploy stacks to. > **Note**: The Failure Tolerance section may need to be adjusted to address any potential failures. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(196).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) m. Click **Next**. n. From the Capabilities section, select the **acknowledgment message**. o. Click **Submit**. p. From the Search bar, type and then select **IAM** in the search bar. q. Click **Roles**. r. Select the stackset you created in this step, and then copy the ARN for this role. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(197).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) s. Paste the ARN of the IAM Role into Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(198).png?sv=2026-02-06&spr=https&st=2026-11-09T12%3A08%3A08Z&se=2026-11-09T13%3A08%3A08Z&sr=c&sp=r&sig=MQQQjQcEqMN2ViuE69J04e0L8FOpWe2UD2QCM9l6fAY%3D) 2. From the Advanced Configuration section, Ingest GuardDuty Finding is selected by default. If you do not want Zscaler MDR to ingest this type of data, deselect Ingest GuardDuty Finding. > [!NOTE] > **Note**: In order for Zscaler MDR to have access to context, analysis, and improved insight into potential risks in your security environment, we recommend that you leave Ingest GuardDuty Finding enabled. 3. Click **Save**. ## **Ingest Details** Zscaler MDR ingests CloudTrail logs and GuardDuty findings from AWS environments. Zscaler MDR also integrates with AWS to regularly scan the environment to discover new accounts and resources. **CloudTrail** AWS CloudTrail monitors and records account activity across your AWS infrastructure and generates CloudTrail logs. Zscaler MDR monitors these logs for signs of suspicious activity or otherwise risky behavior. To ingest the data, Zscaler MDR requires the CloudTrail logs to be stored in an S3 bucket. This makes the integration very flexible and can accommodate multiple AWS Accounts sending CloudTrail telemetry to a single S3 bucket. Permissions summary: The target AWS account must grant a external role within Zscaler MDR permission to read data from the S3 bucket which stores the CloudTrail telemetry. The S3 bucket must publish S3 object write events to a SNS topic, and Zscaler MDR must have permission to subscribe to that topic. **GuardDuty** Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and delivers detailed security findings for visibility and remediation. Zscaler MDR monitors these findings for signs of suspicious activity or otherwise risky behavior, and correlates them with CloudTrail telemetry. Zscaler MDR will attempt to collect findings from every global AWS region for each account which is in scope for the integration. Permissions Summary: Zscaler MDR infrastructure assumes a role within the target AWS environment, and uses available APIs to collect GuardDuty findings on a regular basis. The role must be created and granted the appropriate permissions for Zscaler MDR to ingest GuardDuty findings successfully. If the role does not exist in all enabled AWS regions, we will flag it as an integration error failure. To investigate GuardDuty alerts, Zscaler MDR requires a successfully configured CloudTrail integration. If a CloudTrail integration isn’t active, GuardDuty alerts will be assigned back to your team for investigation. **Environment Scanning** Zscaler MDR regularly scans the target AWS environment for newly created accounts and resources, ensuring that data is properly attributed and monitored as the environment grows and evolves. Zscaler MDR makes read-only API calls to gather this scan data. Permissions Summary: Zscaler MDR infrastructure assumes a role within the target AWS environment, and uses available APIs to collect scan data on a regular basis. If the role does not exist in all enabled AWS regions, we will flag it as an integration error failure.