---
title: "Integrate Amazon Web Services (AWS) with Zscaler MDR"
slug: "integrate-amazon-web-services-with-red-canary"
updated: 2026-11-02T20:24:28Z
published: 2026-11-02T20:24:28Z
canonical: "docs.redcanary.com/integrate-amazon-web-services-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Amazon Web Services (AWS) with Zscaler MDR

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

Zscaler MDR can ingest CloudTrail logs and GuardDuty findings from your Amazon Web Services (AWS) environment, as well as make regular scans of the AWS environment to find newly-created accounts and resources, ensuring that data is properly attributed and monitored as the environment grows and evolves. By integrating AWS with Zscaler MDR, you can enhance your cloud security operations by centralizing monitoring, enabling effective threat detection and response, and facilitating automated actions.

**CloudTrail** AWS CloudTrail monitors and records account activity across your AWS infrastructure and writes the results to logs. To ingest this data, Zscaler MDR requires the CloudTrail logs to be stored in an S3 bucket. We then monitor the ingested logs for signs of suspicious activity.

**GuardDuty** Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts, workloads, and data for malicious activity and delivers detailed security findings for visibility and remediation. To ingest this data, Zscaler MDR requires the GuardDuty findings to be stored in an S3 bucket. **We then bring the GuardDuty findings into our system as alerts,** analyze them for signs of suspicious activity, and correlate them with the CloudTrail telemetry. Although you can integrate AWS and Zscaler MDR without GuardDuty, we strongly recommend turning it on. For more information, see the [AWS Integration FAQ](/doc/docs/aws-integration-faq).

> [!NOTE]
> See [Best Practices for CloudTrail and GuardDuty Setup](/doc/docs/best-practices-for-cloudtrail-and-guardduty-setup) for more information on how to configure these components.

> [!WARNING]
> Account Limits
> 
> Zscaler MDR restricts all cloud integrations to 2,000 accounts or external services in a single subdomain. Please contact your Customer Success Manager if you anticipate hitting this limit.

## Prerequisites

Before you start the Amazon Web Services integration, please make sure the following requirements are met:

- You’re subscribed to the Zscaler MDR Cloud Control Plane license
- You have the following AWS infrastructure in place:
  - CloudTrail is set up to store its logs in an S3 bucket
  - GuardDuty (if used) is set up to store its findings in an S3 bucket
  - ACLs are disabled on the S3 buckets ([recommended by Amazon](https://aws.amazon.com/blogs/storage/disabling-acls-for-existing-amazon-s3-workloads-with-information-in-s3-server-access-logs-and-aws-cloudtrail/#:~:text=disable%20ACLs.-,Step%205%3A%20Disable%20ACLs,-Now%20that%20ACL))

> [!NOTE]
> **Note:** For organization-level integrations, the S3 buckets used by CloudTrail and GuardDuty must be in that organization

- You have an AWS Console admin account with permissions to:
  - Create Simple Notification Service (SNS) topics
  - Adjust resource policies on SNS topics
  - Set notifications on S3 buckets
  - Adjust resource policies on S3 buckets
  - Adjust resource policies on KMS keys
  - Create IAM roles

## 1 Zscaler MDR | Add the Integration

The first step is to add the new integration in Zscaler MDR.

1. In the Zscaler MDR portal, go to the **Integrations** page then click **Add Integration**. ![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
2. On the **Add integration** dialog, search for the **Amazon Web Services** integration then click **Configure**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. On the **Add Integration page**, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

**Autodetect**

You can optionally use the **Autodetect** wizard to scan your AWS environment and automatically fill out many of the integration values required in the steps below.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-1_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

Click **Autodetect** and follow the instructions on the **Autodetect your AWS configuration** dialog to retrieve the values. Then click **Use autodetected values** to populate the fields on the configuration page.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-1_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

If any of the values can’t be autodetected, or if you need to override any of the suggestions, you can still complete all the steps manually as described below.

## 2 Zscaler MDR/AWS | Choose the Integration Scope

You can choose to integrate a single account, or you can integrate multiple accounts simultaneously if they’re grouped under an AWS organization.

1. In the **Choose the scope of integration** section, select the scope: **Organization** - Scan your AWS organization and all its member accounts **Account** - Scan a single AWS account ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

**Organization Scope**

If you chose Organization scope:

1. If you don’t already know your **AWS Organization ID** and **AWS Management Account ID**, copy them from the **AWS Organizations** dashboard in your **AWS Console**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-2_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
2. Enter the **AWS Organization ID** and **AWS Management Account ID** into the Zscaler MDR configuration page. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-2_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Select the accounts you want to include:

**All accounts in this organization** - Scan every account. You can optionally enter a comma-separated list of account IDs that will be excluded from the scan. **Only specific accounts** - Enter a comma-separated list of the accounts you want to scan.
4. Click **Next**.

**Account Scope**

If you chose Account scope:

1. If you don’t already know your **AWS Account ID**, copy it from the **Billing and Cost Management** > **Account** page in your **AWS Console**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-2_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D) For additional help, see [Finding your AWS account ID](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-identifiers.html#:~:text=that%20you%20have.-,Finding%20your%20AWS%20account%20ID,-You%20can%20find).
2. Enter the **AWS Account ID** into the Zscaler MDR configuration page. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-2_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Click **Next**.

## 3 Zscaler MDR/AWS | Identify the CloudTrail S3 Bucket

Zscaler MDR reads your CloudTrail logs from an S3 bucket. In order to configure the integration, you’ll need to provide the ARN of the S3 bucket and (optionally) the KMS key used to encrypt the bucket.

Zscaler MDR also needs to subscribe to an SNS topic in order to receive messages as data is added to the S3 bucket.

> [!NOTE]
> Note
> 
> Creating a new CloudTrail for Zscaler MDR could increase your AWS bill. To avoid additional costs, we recommend using a pre-existing CloudTrail. For more information, see [Managing CloudTrail trail costs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-trail-manage-costs.html).

### Get the ARN of the CloudTrail Logs S3 Bucket

1. Navigate to the **CloudTrail Dashboard** in your **AWS Console**.
2. In the **Trails** panel, click on the active Trail name. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Click the **Trail log location**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
4. Click the CloudTrail location in the breadcrumbs section. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
5. Go to the **Properties** tab and copy the **Bucket ARN**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

### Get the ARN of the CloudTrail S3 Bucket KMS Encryption Key

> [!NOTE]
> Note
> 
> AWS doesn’t require encryption for the CloudTrail S3 bucket. If you’re not using encryption, you can skip this step.

1. Navigate to the **Amazon S3 > General purpose buckets** page in your **AWS Console**.
2. In the **General purpose buckets** panel, click on the bucket you’re using to send data to Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Go to the **Properties** tab and copy the **Encryption key ARN** from the **Default encryption** panel. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

> [!NOTE]
> Note
> 
> The **Encryption key ARN** won’t be displayed if KMS encryption isn’t enabled. To change the default encryption:
> 
> 1. Click **Edit**.
> 2. Change **Encryption type** to “Server-side encryption with AWS Key Management Service keys (SSE-KMS)”
> 3. Choose an existing KMS key, or create a new one. The **Key usage** must be “Encrypt and decrypt.”
> 4. Save the changes then copy the resulting **Encryption key ARN**.

### Enter the CloudTrail ARNs into Zscaler MDR

1. In the **Identify S3 bucket containing CloudTrail logs and SNS Topic** section on the Zscaler MDR configuration page, enter the **Bucket ARN** and **Encryption key ARN**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_07.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

### Create an SNS Topic for CloudTrail Logging Bucket Notifications

You need to set up an SNS topic in AWS to receive event notifications when data is added to the CloudTrail logs S3 bucket.

1. Navigate to the **Simple Notification Service** page in your **AWS Console**.
2. Click **Create topic**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_08.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Choose **Standard** as the topic type and enter a topic name. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_09.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
4. Click **Create topic**.
5. Copy the **SNS topic ARN**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_10.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
6. Enter the **SNS topic ARN** on the Zscaler MDR configuration page.

> [!NOTE]
> Note
> 
> If your SNS topic and KMS key belong to different AWS accounts, you’ll need to [update the key policy in AWS](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) to enable cross-account KMS access. The configuration page will auto-generate the JSON statement you can use to update the policy.
7. Click **Next**.

### Send CloudTrail S3 Bucket Event Notifications to the SNS Topic

You need to configure the S3 bucket to send notifications to the SNS topic whenever a data event occurs.

1. Navigate to the **Amazon S3 > General purpose buckets** page in your **AWS Console**.
2. In the **General purpose buckets** panel, click on the bucket you’re using to send data to Zscaler MDR. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_12.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Go to the **Properties** tab.
4. In the **Event notifications** panel, click **Create event notification**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_13.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
5. Enter a name for your event notification.
6. In the **Event types** panel, select **All object create events**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_14.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

> [!WARNING]
> Important
> 
> Please leave the optional **Prefix** and **Suffix** values blank unless you’re confident you understand the effect of these filters in your environment. Misconfiguration can prevent event notifications being sent to Zscaler MDR.
7. In the **Destination** panel, select **SNS topic** and choose the topic you created earlier.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_15.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
8. Click **Save changes**.

> [!NOTE]
> If the topic is correctly set up, you should see it populate with two subscriptions after you finish and activate the integration.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-3_16.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

## 4 Zscaler MDR/AWS | Identify the GuardDuty S3 Bucket

Zscaler MDR reads your GuardDuty alerts from an S3 bucket. In order to configure the integration, you’ll need to provide the ARN of the S3 bucket and the KMS key used to encrypt the bucket.

Zscaler MDR also needs to subscribe to an SNS topic in order to receive messages as data is added to the S3 bucket.

> [!NOTE]
> OPTIONAL
> 
> If you don’t want Zscaler MDR to ingest your GuardDuty alerts, you can skip this section and leave the GuardDuty fields blank on the integration configuration page.
> 
> Note that if you decide to add GuardDuty alerts later, you’ll need to repeat [Step 5](/docs/integrate-amazon-web-services-with-red-canary#5-red-canaryaws-provision-an-iam-role) below to re-provision the IAM role and update the permissions.

### Get the ARNs of the GuardDuty Alerts S3 Bucket and KMS Encryption Key

1. Navigate to the **GuardDuty > Settings** page in your **AWS Console**.
2. In the **Findings export options** panel, click **Edit** for the S3 bucket. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-4_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. Copy the **S3 Bucket ARN** and the **KMS Key ARN**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-4_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
4. Click **Cancel**.

### Enter the GuardDuty ARNs into Zscaler MDR

1. In the **Identify S3 bucket containing GuardDuty alerts and SNS Topic** section on the Zscaler MDR configuration page, enter the two ARNs for GuardDuty. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-4_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

### Create an SNS Topic for GuardDuty Alerts Bucket Notifications

You need to set up an SNS topic in AWS to receive event notifications when data is added to the GuardDuty alerts S3 bucket. The steps for creating the SNS topic are the same as for CloudTrail (see [Create an SNS Topic for CloudTrail Logging Bucket Notifications](/docs/integrate-amazon-web-services-with-red-canary#3)).

1. After you’ve created the SNS topic in AWS, enter the ARN on the Zscaler MDR configuration page.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-4_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
2. Click **Next**.

### Send GuardDuty S3 Bucket Event Notifications to the SNS Topic

The steps for setting up an SNS topic to receive GuardDuty event notifications are the same as for CloudTrail (see [Send CloudTrail S3 Bucket Event Notifications to the SNS Topic](/docs/integrate-amazon-web-services-with-red-canary#4)).

## 5 Zscaler MDR/AWS | Provision an IAM Role

To give Zscaler MDR the necessary access, you need to provision an appropriately-configured IAM role in your AWS environment. The integration UI will generate a template which contains all the values needed to create the role. The role name is **redcanary-partner-access**.

### Generate the Template in Zscaler MDR

1. In the **Provision an IAM role in the Account(s) Being Configured** section on the Zscaler MDR configuration page, select **CloudFormation** or **Terraform** to generate the appropriate template. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
2. Copy and paste the template into a new file and save it. You’ll upload this file to AWS later.

### Provision the IAM Role in AWS

To provision the IAM role for Zscaler MDR to use, you must apply the CloudFormation or Terraform template to the appropriate accounts in AWS. The process is different depending on whether your integration scope is Organization or Account.

**Organization Scope**

If you’re integrating at the Organization level, follow these instructions to ensure Zscaler MDR has the necessary role in all the accounts.

> [!WARNING]
> Important
> 
> When creating roles at the Organization level, make sure you’re logged in to the management account in AWS.

### For CloudFormation

In CloudFormation you need to create a single stack and deploy it to your management account first. You can then use the same template to generate a stack set for deployment to the rest of the accounts in the organization.

#### Create a Stack

1. Navigate to the **CloudFormation > Stacks** page in your **AWS Console**.
2. Click **Create stack** and select **With new resources (standard)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. On the **Create stack** page:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
  - In the **Prerequisite - Prepare template** panel, select **Choose an existing template**
  - In the **Specify template** panel, select **Upload a template file**
  - Click **Choose file** to upload the template file you created earlier
4. Click **Next**.
5. On the **Specify stack details** page, enter a name for your new stack and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
6. On the **Configure stack options** page, accept the acknowledgment message and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
7. On the **Review and create** page, copy the **Template URL**. You’ll use this to create a stack set for the rest of the accounts in the organization. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_06.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
8. Click **Submit** to create the stack.

#### Create a StackSet

1. Navigate to the **CloudFormation > StackSets** page in your **AWS Console**.
2. Click **Create Stackset**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_07.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. On the **Choose a template** page:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_08.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
  - In the **Prerequisite - Prepare template** panel, select **Template is ready**
  - In the **Specify template** panel, enter the **Amazon S3 URL** for the template which you copied when you created the stack
4. Click **Next**.
5. On the **Specify StackSet details** page, enter a name for your new stack set and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_09.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
6. On the **Configure StackSet options** page, accept the acknowledgment message and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_10.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
7. On the **Set deployment options** page:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_11.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
  - In the **Deployment targets** panel, make sure you’re deploying to the organization
  - In the **Specify Regions** panel, select the regions you want to deploy the stacks to (typically, all regions)
  - In the **Deployment options** panel, adjust the **Failure tolerance** setting to address any potential failures
8. Click **Next**.
9. On the **Review** page, click **Submit** to create the stack set.

**For Terraform**

Terraform usage is dependent on your environment. If you need assistance with the Terraform template, please contact Zscaler MDR Support.

**Account Scope**

If you’re integrating individual AWS accounts, follow these instructions to deploy the IAM role for each account.

### For CloudFormation

1. Navigate to the **CloudFormation > Stacks** page in your **AWS Console**.
2. Click **Create stack** and select **With new resources (standard)**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
3. On the **Create stack** page:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
  - In the **Prerequisite - Prepare template** panel, select **Choose an existing template**
  - In the **Specify template** panel, select **Upload a template file**
  - Click **Choose file** to upload the template file you created earlier
4. Click **Next**.
5. On the **Specify stack details** page, enter a name for your new stack and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_04.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
6. On the **Configure stack options** page, accept the acknowledgment message and click **Next**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_05.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
7. On the **Review and create** page, click **Submit** to create the stack.

### For Terraform

Terraform usage is dependent on your environment. If you need assistance with the Terraform template, please contact Zscaler MDR Support.

### Confirm the IAM Role in Zscaler MDR

When you’ve finished provisioning the IAM role in AWS, check the **Access granted** box on the Zscaler MDR configuration page. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-5_12.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

## 6 Zscaler MDR | Customize How Data is Retained

[OPTIONAL] If you’re subscribed to the [Zscaler Security Data Lake](/doc/docs/getting-started-with-the-security-data-lake) managed storage solution, you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval.

1. Check the **Store in the Security Data Lake** box.
2. Enter your desired data retention period in days. The maximum is 1095 days (three years). ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-6_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)

## 7 Zscaler MDR | Activate the Integration

After you’ve completed the configuration, click **Save** to activate the integration.

> [!TIP]
> The AWS integration is now live!
> 
> You should see AWS alerts start appearing in Zscaler MDR within one hour.

## 8 Zscaler MDR | Modify the Integration

After the AWS integration is active, you can make the following modifications to the configuration:

- Change the S3, SNS, and KMS ARNs
- Edit the list of included/excluded AWS accounts
- Add or remove GuardDuty
- Decommission the integration

To modify the configuration:

1. In the Zscaler MDR portal, go to the **Integrations** page then click on the name of the integration you want to modify. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/aws-8_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D)
2. After you’ve finished the editing the configuration, click **Save** to apply your changes.

#### Decommissioning the Integration

To remove the integration from Zscaler MDR, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button-2.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A25Z&se=2026-11-04T16%3A05%3A25Z&sr=c&sp=r&sig=tXB5SMXt0T8tAYIdguVBSGTJpWA%2BKMKB6R0%2FKcZbwu0%3D) button then click **OK** to confirm.

> [!WARNING]
> Important
> 
> If you decommission the integration, no new alerts will be sent to Zscaler MDR. Although threats will be retained, all processed alerts will be deleted. This action cannot be undone.