AWS CloudTrail Manual Setup - New Trail

This manual setup guide is for those who do not have an existing trail available for use in their CloudTrail service.

If you would like to use the Wizard instead, see Setup Options.

This guide takes you through all required manual configurations when creating a new trail in AWS, to allow Expel to access your S3 bucket securely via an API. It also shows you how to add CloudTrail as a security device in Workbench, which completes the integration and enables you to monitor all activity.

Scope and Limitations

When choosing to set up this integration, remember the following:

• The AWS setup described here is Expel’s recommended best practice.
• There are a number of ways to customize your AWS configurations based on your own environment or protocols. These steps are intended to show the necessary settings that must be configured in order for your Expel integration to work, with basic instructions for how to do so; they do not cover most of the optional settings or explain every possible option in AWS.

Prerequisites

1. Verify you have the necessary permissions to create and modify IAM policies and roles for your AWS account.
2. Make sure you are in the management console and that you have your AWS Account ID if you are using AWS Organizations, or are in the proper AWS account if you manage more than one account.
3. If your organization centralizes CloudTrail logs from multiple subsidiaries into a single S3 bucket, make sure you know the AWS Organizational Unit (OU) ID for the subsidiary.

   • This is an optional prerequisite that enables us to filter logs so that only the relevant data is sent to each subsidiary's Workbench instance, preventing data overlap.
4. Check the AWS region in the top menu bar (i.e. us-east-2, us-west-1, etc.) and make sure you are in the home region you want to be in; you must use the same home region throughout the entire AWS configuration process, and you must later specify this region correctly in Workbench.
5. Make sure you can log into Workbench successfully, and are able to see your organization settings.

   • This is a good time to copy and save your Workbench GUID, which is a unique alphanumeric value assigned by Expel to your organization and found in the My Organization page; see the Reference for detailed instructions.
6. Create a new file or other space to keep track of all of the names, ARNs, and other values from the AWS configuration as you go (a list of all needed values is available in Step 2, and additional help is available in the Reference).

Step 1: Download the CloudFormation Templates

CloudFormationTemplates.zip

archive · 3KB

Open

Template	Application	Actions
CloudFormationTemplate_Accounts.json	For those with a single AWS account and/or those who need to update the management account Used when deploying a stack	Creates Expel's IAM role (ExpelAssumeRole) in your management account Creates the required IAM policy (ExpelAccessPolicy); you will define the SQS queue, S3 bucket, and AWS KMS key ARN
CloudFormationTemplate_Orgs.json	For those using AWS Organizations Used when deploying a stackset	Creates Expel's IAM role (ExpelAssumeRole) in your children accounts; you will create this role in your management account separately Creates the required IAM policy (ExpelAccessPolicy) for your children accounts; you will grant additional access separately

Step 2: Make Note of Your Needed Values

During the AWS configuration process, you will need to copy out and save a number of values as they are added by you (e.g. the AWS KMS Alias) or generated by AWS (e.g. the SQS Queue ARN). Knowing each of these values is necessary to successfully complete all AWS configuration steps and to also add AWS as a security device in Workbench.

For examples of what some of these values look like or instructions on where to find them if you forget to save one of them, refer to the Reference section.

These values include, in the order they are created or generated:

• Workbench GUID (if you do not have it yet, get it now)
• AWS Account ID (AWS organizations only; get it now)
• AWS OU ID (only if you use a single S3 bucket for multiple subsidiaries; get it now)
• AWS Region
• S3 Bucket Name
• AWS KMS Alias
• S3 Bucket ARN
• SNS Topic ARN
• AWS KMS Key ARN
• SQS Queue ARN
• SQS URL
• IAM Role ARN
• AWS OU Role ARN (only if you use a single S3 bucket for multiple subsidiaries and you choose to create a separate IAM Role with the additional permissions)

Step 3: Create a New Trail

In this step, you will create a new trail, new S3 bucket, and new AWS KMS key within your chosen home region.

Before you begin:

• Make sure you are in the proper AWS account (if you manage more than one AWS account)
• Make sure you are in the management console (if you use AWS Organizations).
• Make sure you are in the home region you wish to set for the trail (e.g. us-west-1); you will need to be in the same home region throughout this guide, and also choose the correct region in Workbench in Step 11.

1. Use the Search bar to quickly navigate to Cloudtrail, or find it in the Services menu.
2. Select Create trail.
3. Enter a trail name, such as "ExpelCloudTrail".
4. AWS Organizations only - select the “Enable for all accounts in my organization” checkbox.
5. In Storage location, leave Create new s3 bucket selected.

   • Use the default for the Trail log bucket and folder, or enter a new unique name. Remember that if you choose to create your own name, it must be unique to ALL of AWS — not just to your instance — or the trail creation will fail. You can append your desired name with the alphanumeric values from the default name to ensure uniqueness.
   • Make a note of your S3 bucket name, as you will need it in a later step.
   • Leave Log file SSE-KMS encryption as Enabled.
   • Leave the New radio button selected.
   • Enter a name for AWS KMS alias.
   • Make a note of your AWS KMS alias, as you will need it in a later step.
6. In Additional settings:

   • Leave Log file validation as Enabled.
   • Leave SNS notification delivery unchecked.
7. Leave the CloudWatch Logs and Tags section as is, unless you need to change them for your own protocols, and do not edit the Policy document.
8. Select Next.
9. Leave the Choose Log Events screen as is.
10. Select Next.
11. You can now review your trail’s settings before creating it, if you wish.
12. Select Create trail.
13. You will be taken to the Trails list and should see your new trail.

Step 4: Edit the S3 Bucket Encryption Settings

In this step, you will set your default S3 bucket encryption to server-side encryption with AWS Key Management Service keys (SSE-KMS), and instruct Amazon to use your AWS KMS key’s encryption policy for your log files instead of using SSE-S3 encryption (Amazon’s default).

You will configure the key’s policy in a later step.

1. Use the Search bar to quickly navigate to S3, or find it in the Services menu.
2. Look for your new S3 bucket in the list and select it.
3. Select the Properties tab.
4. First, copy the ARN and save it to a safe place as your S3 Bucket ARN (you will need it for the next section). The format should look something like this: arn:aws:s3:::YourS3BucketName
5. Next, scroll to Default encryption and select Edit.
6. Select Server-side encryption with AWS Key Management Service keys (SSE-KMS).
7. Under AWS KMS key, select Choose from your AWS KMS keys.
8. Select the AWS KMS key you created earlier (the alias will display in small print below the key).
9. Leave the Bucket Key as Enable.
10. Select Save changes.

Step 5: Create a New SNS Topic

Now, you will create an SNS topic and edit its access policy to give the S3 bucket permission to push events to the topic. These communications will eventually be sent from the SNS topic to an SQS queue (configured in a later section).

1. Use the Search bar to quickly navigate to Simple Notification Service (SNS), or find it in the Services menu.
2. Select Topics.
3. Select Create topic.
4. In the Details section:

   • Select Standard as the Type.
   • Enter a topic name in the Name field.
5. Expand the Encryption section:

   • Toggle Encryption to on.
   • Use the dropdown menu to select your AWS KMS Key (or search for the alias if you do not see it).
6. Expand the Access Policy section:

   • Leave the method as Basic.
   • Look at the JSON preview and scroll down to the Resource key.
   • Copy the Resource value and save it to a safe place as your SNS Topic ARN (you will need it to configure the new access policy). The format should look something like this: arn:aws:sns:us-east-1:123456789012:YourTopicName
   • Now, select the Advanced button to define a new access policy.
   • Highlight and delete the existing policy and paste the below policy instead.

Make sure to use your SNS Topic ARN as the Resource value and your S3 Bucket ARN as the aws:SourceARN value.

{
  "Version": "2008-10-17",
  "Id": "expel-topic-policy-ID",
  "Statement": [
    {
      "Sid": "expel-statement-ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:Publish"
      ],
      "Resource": "YOUR_SNS_TOPIC_ARN",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "YOUR_S3_BUCKET_ARN"
        }
      }
    }
  ]
}

Important: Did you use your SNS Topic ARN and S3 bucket ARN in the new code? Check to be sure before continuing.

1. Leave the remaining sections as is and select Create topic.

Step 6: Edit the AWS KMS Key Policy

In an earlier step, you configured your S3 bucket to use your AWS KMS key for encryption. Now, you must append the key’s encryption policy to allow the S3 bucket and SNS topic to communicate securely via encryption.

1. Use the Search bar to quickly navigate to Key Management Service, or find it in the Services menu.
2. From the Customer Managed Keys list, select your AWS KMS alias.
3. First, copy the ARN and save it to a safe place as your AWS KMS Key ARN (you will need it in a later step). The format should look something like this: arn:aws:kms:us-west-2:123456789012:key/123a4567-890b-1234-c5d6-7ef89012g345
4. In the Key policy section, select Edit and append these JSON objects to the code.

Make sure to use your S3 Bucket ARN and SNS Topic ARN as the aws:SourceARN values.

,
{ 
 "Sid": "Allow cloudtrail bucket to encrypt/decrypt",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
       "Action": [
               "kms:GenerateDataKey",
               "kms:Decrypt"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:SourceArn": "YOUR_S3_BUCKET_ARN"
                }
            }
        },
{
    "Sid": "Allow SNS to encrypt/decrypt",
    "Effect": "Allow",
    "Principal": {
        "Service": "sns.amazonaws.com"
    },
    "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
    "Resource": "*",
    "Condition": {
        "StringLike": {
            "aws:SourceArn": "YOUR_SNS_TOPIC_ARN"
        }
    }
}

Important: Did you use your S3 bucket ARN and SNS Topic ARN in the appended code? Check to be sure before continuing.

1. Select Save changes.

Step 7: Create the SQS Queue

Next, you will create a dedicated SQS queue to receive messages from the SNS topic, and edit the access policy to allow the SNS topic to send messages to it. Expel will use this queue to poll for notifications of new CloudTrail data, and then will update Workbench accordingly.

1. Use the Search bar to quickly navigate to Simple Queue Service (SQS), or find it in the Services menu.
2. Select Create queue.
3. In the Details section:

   • Leave Standard as the Type.
   • Enter a name in the Name field.
4. In the Configuration section:

   • Change the Message Retention period to 7 days.
   • Leave all other defaults.
5. In the Encryption section:

   • Leave Server-side encryption as Enabled.
   • Choose AWS Key Management Service key (SSE-KMS) as the encryption key type.
   • Choose your AWS KMS Alias from the Customer master key dropdown.
   • Leave the data key reuse period as the default.
6. In the Access policy section:

   • Select Advanced.
   • First, go to the Resource value and copy the ARN, then save it to a safe place as your SQS Queue ARN (you will need it for your new access policy).
   • Highlight and delete the existing policy and paste the below policy instead.

Make sure to use your SQS Queue ARN as the Resource value and your SNS Topic ARN as the aws:SourceARN value.

{
  "Version": "2012-10-17",
  "Id": "SQSDefaultPolicy",
  "Statement": [
    {
      "Sid": "Sid1572965666162",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": "SQS:SendMessage",
      "Resource": "YOUR_SQS_QUEUE_ARN",
      "Condition": {
        "StringEquals": {
          "aws:SourceArn": "YOUR_SNS_TOPIC_ARN"
        }
      }
    }
  ]
}

Important: Did you use your SQS Queue ARN and SNS Topic ARN in the new code? Check to be sure before continuing.

1. Leave the remaining sections as is and select Create queue.
2. Before leaving the confirmation screen, copy the URL and save it to a safe place as your SQS URL (you will need it in a later step).

Step 8: Create the SNS Subscription

Now that you have the SNS topic and SQS queue, and have also edited both of their access policies to allow for communication, you need to create a subscription within the SNS topic so that the topic can send events to the queue.

1. Use the Search bar to quickly navigate to Simple Notification Service (SNS), or find it in the Services menu.
2. Select Subscriptions.
3. Select Create subscription.
4. In the Details section:

   • Select your SNS Topic ARN.
   • Select Amazon SQS as the protocol.
   • Select your SQS Queue ARN as the endpoint.
   • Select the Enable raw message delivery checkbox.

Selecting the raw message delivery option ensures SNS does not add metadata to the events it sends to SQS, so be sure it is enabled.

1. Leave the remaining sections as is and select Create subscription.

Step 9: Enable S3 Event Notifications

Now that you've fully configured the communications between the SNS topic and SQS queue, you can create an event notification. This notification will tell the S3 bucket to send certain events (you will specify which ones) to the SNS topic whenever CloudTrail adds event logs to the bucket.

1. Use the Search bar to quickly navigate to S3, or find it in the Services menu.
2. Select your S3 bucket.
3. Select Properties.
4. Go to the Event Notifications section and select Create event notification. Then:

   • Enter an event name.
   • In the Event types section, use the checkbox to enable All object create events. Leave the rest of the boxes unchecked.
   • In the Destination section, select SNS topic and then choose your SNS topic from the dropdown.
5. Select Save changes.

Step 10: Set Up CloudFormation

Expel will authenticate its credentials using an IAM Role, and will be granted permissions to your AWS account(s) based on a corresponding IAM policy. You can complete this step most efficiently by using CloudFormation instead of doing a manual configuration via IAM.

AWS Organizations Instructions

If you use AWS Organizations, you will first create a stackset in the management account (this is where the primary Expel role resides) using our CloudFormation template. Then you will create an additional stack, with a different CloudFormation template, that is just for the management organization.

Before you begin, make sure you have downloaded and unzipped the CloudFormationTemplates.zip file from Step 1. Make sure you also have your SQS Queue ARN, S3 Bucket ARN, AWS KMS Key ARN, and Workbench GUID.

Step 1: Create a Stackset in the Management Account

This stackset allows AWS to automatically replicate and deploy the template's IAM role and policy via stacks to all of the other accounts in your organization. The permissions in the template enable Expel to perform all necessary Investigative Actions, and also prevent you from having to update or redo the configuration if a new account is added to your organization.

1. Use the Search bar to quickly navigate to CloudFormation, or find it in the Services menu.
2. Go to StackSets.
3. Select Create StackSet.

If you see a dropdown menu, choose the "With new resources" option.

1. For the template:

   • Leave Permissions as Service-managed permissions.
   • Leave the Prerequisite as Template is ready.
   • For the template source, choose Upload a template file.
   • Choose the CloudFormationTemplate_Orgs.json template file.
2. Select Next.
3. Configure your stackset details:

   • Enter a name for your stackset.
   • Enter your Workbench GUID.
4. Select Next.
5. Leave Tags and Execution configuration as is.
6. Select Next.
7. For your deployment options:

   • Scroll down to Specify regions and choose your AWS region.
   • Leave all other defaults on this page as is.
8. Select Next.
9. Review your configuration if desired, and select Submit.

Step 2: Create an Additional Stack

This stack will enable additional permissions related to the SQS Queue ARN, S3 Bucket ARN, and KMS Key ARN.

1. Use the Search bar to quickly navigate to CloudFormation, or find it in the Services menu.
2. Go to Stacks.
3. Select Create stack.

If you see a dropdown menu, choose the "With new resources" option.

1. For your stack:

   • Leave the Prerequisite as Template is ready.
   • For the template source, choose Upload a template file.
   • Choose the CloudFormationTemplate_Accounts.json template file.
2. Select Next.
3. Configure your stack details:

   • Enter a name for your stack.
   • Enter your AWS KMS Key ARN, S3 Bucket ARN, SQS Queue ARN, and Workbench GUID.
4. Select Next.
5. Leave all defaults for stack options as is.
6. Select Next.
7. Review your configuration if desired, and select Submit.
8. Now, you must grab your IAM Role ARN (you will need it for a later step). First, use the Search bar to quickly navigate to IAM, or find it in the Services menu.
9. Go to Roles.
10. Look for ExpelAssumeRole and select it.
11. In the Summary section, copy the ARN and save it to a safe place as your IAM Role ARN.

Step 3: Update the IAM Role

Skip this step if the situation does not apply to you.

If your organization centralizes CloudTrail logs from multiple subsidiaries into a single S3 bucket, you will need to either edit this IAM Role to add two additional permissions for Expel, or create a separate IAM role with those permissions.

The two additional permissions are:

• organizations:ListAccountsForParent
• organizations:ListOrganizationalUnitsForParent

If you wish to create a separate IAM Role with the two permissions, make sure to save that IAM Role ARN as your AWS OU Role ARN. You will need it when you set up the security device in Workbench.

AWS Single Account Instructions

Creating a stack with our CloudFormation template is the recommended best practice for single accounts because it is a faster configuration process that is less likely to fail due to human error. However, you may use IAM to create your policy and role manually if you wish, and skip the below steps.

Before you begin, make sure you have downloaded and unzipped the CloudFormationTemplates.zip file from Step 1. Make sure you also have your SQS Queue ARN, S3 Bucket ARN, AWS KMS Key ARN, and Workbench GUID.

1. Use the Search bar to quickly navigate to CloudFormation, or find it in the Services menu.
2. Go to Stacks.
3. Select Create stack.

If you see a dropdown menu, choose the "With new resources" option.

1. For your stack:

   • Leave the Prerequisite as Template is ready.
   • For the template source, choose Upload a template file.
   • Choose the CloudFormationTemplate_Accounts.json template file.
2. Select Next.
3. Configure your stack details:

   1. Enter a name for your stack.
   2. Enter your AWS KMS Key ARN, S3 Bucket ARN, SQS Queue ARN, and Workbench GUID.
4. Select Next.
5. Leave all defaults for stack options as is.
6. Select Next.
7. Review your configuration if desired, and select Submit.
8. Now, you must grab your IAM Role ARN (you will need it for the next section). First, use the Search bar to quickly navigate to IAM, or find it in the Services menu.
9. Go to Roles.
10. Look for ExpelAssumeRole and select it.
11. In the Summary section, copy the ARN and save it to a safe place as your IAM Role ARN.

Step 11: Add AWS CloudTrail as a Security Device in Workbench

Now, you can add a security device in Workbench to complete the integration.

Before you begin, make sure you have your IAM Role ARN and SQS URL. If you use AWS Organizations, you will also need your AWS Account ID as well as the subsidiary's AWS Organizational Unit (OU) ID (the OU ID is only necessary if you use a single S3 bucket for multiple subsidiaries).

If you need additional help finding any of these values, see the Reference for detailed instructions.

1. Log in to Workbench.
2. In the side menu, navigate to Organization Settings > Security Devices.
3. Select Add Security Device.
4. In the search box, enter “AWS” and then select the AWS CloudTrail integration.
5. Select the bullets as follows:

   • “Are you using AWS organizations?” - AWS Organizations should leave it as Yes; single accounts should select No.
   • “Do you have an existing CloudTrail that you want Expel to reuse?” - select No.
   • “How would you like to connect?” - select Manual connection.
6. Select Save.
7. On the next screen, complete the fields as follows:

   • Name - enter a name that might help you more easily identify this integration, such as “CompanyName CloudTrail”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   • Location - enter the location of your integration, for example “cloud” or “AWS cloud” or “on prem;” this is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   • Role ARN - enter the IAM Role ARN you saved earlier. Format: arn:aws:iam::123456789012:role/RoleName
   • Role session name - enter a text string to label your IAM role session, such as "orgname-expel-trail-session".
   • AWS region - choose the AWS region where you created your configuration in AWS.
   • SQS URL - enter the SQS URL you copied and saved in a previous step.
   • Organization management account - If you use AWS Organizations, input your AWS Account ID; single account users can leave this field blank.
   • AWS OU ID - if you use AWS Organizations to centralize CloudTrail logs from multiple subsidiaries into a single S3 bucket, enter the AWS OU ID for the relevant subsidiary (format: ou-abc1-defghi2j); otherwise, leave this field blank. This field tells our system to filter the logs based on that ID, ensuring that each subsidiary's Workbench instance only ingests and analyzes the logs relevant to its own accounts, which helps prevent any overlap of data.
   • AWS OU Role ARN - if you entered an AWS OU ID, you will also need to enter the IAM Role ARN that contains the appropriate permissions. If you chose to add these permissions to your existing IAM Role in Step 10, enter the IAM Role ARN again here. If you chose to create a new IAM Role with those permissions, enter your AWS OU Role ARN. Otherwise, leave this field blank.
8. Select Save.

Your device should be created successfully within a few seconds. A few reminders:

• After your connection is healthy, it will take some time for your device to begin polling and receiving data.
• To check on the status, select the downward arrow for your device in the first column and choose View details.
• Polling will happen first; data will be received after that. You must refresh the page to see updates.
• If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, contact our support team for help.
• To check if alerts are coming through, navigate to Dashboards > Alert Analysis. Scroll to the device you want to check, and select the Expel Alerts tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Troubleshooting

S3 Event Notification Errors (Step 9)

This error is encountered when selecting Save changes in Step 9. It generally displays for one of the following reasons:

• You left one of your ARN values out of a JSON object in a prior step, put an ARN in the wrong location, or formatted an ARN incorrectly.
• The JSON objects were copied, appended, or formatted incorrectly in a prior step.
• You used an S3 bucket name that someone else in the AWS ecosystem is already using (even if nobody at your organization is using it).
• You have forgotten to enable something, or have configured something incorrectly, in one of the prior steps. Examples: Not choosing your AWS KMS key from the dropdown menu when setting up default encryption in step 4, or not using the same region throughout your AWS configuration.

S3 Bucket Naming

You must use an S3 bucket name that nobody else in the AWS ecosystem is using. You can avoid this problem by using the default name, or by appending your chosen name with the numerical values from the default name that is generated.

Appending JSON Files

Make sure to put this JSON snippet in the correct place, using a comma, and make sure the final bracket is still there. Lines 78-133 of your JSON code should look like this (the appended part is highlighted, beginning with the ,):

  {
            "Sid": "Enable cross account log decryption",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "kms:Decrypt",
                "kms:ReEncryptFrom"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:CallerAccount": "484330702365"
                },
                "StringLike": {
                    "kms:EncryptionContext:aws:cloudtrail:arn": "arn:aws:cloudtrail:*:484330702365:trail/*"
                }
            }
        },
        {
            "Sid": "Allow cloudtrail bucket to encrypt/decrypt",
            "Effect": "Allow",
            "Principal": {
                "Service": "s3.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:SourceArn": "arn:aws:s3:::S3BucketName"
                }
            }
        },
        {
            "Sid": "Allow SNS to encrypt/decrypt",
            "Effect": "Allow",
            "Principal": {
                "Service": "sns.amazonaws.com"
            },
            "Action": [
                "kms:GenerateDataKey",
                "kms:Decrypt"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "aws:SourceArn": "arn:aws:sns:us-east-1:123456789012:SNSTopicName"
                }
            }
        }
    ]

Reference

ARNs and URLs

This chart gives examples of ARNs and the SQS URL so you can check on the general formatting, and also tells you where to find any of the values if you’ve forgotten to copy and save them during the configuration process.

Value	Where to Find	Example
S3 Bucket ARN	S3 > Buckets > bucket name > Properties	arn:aws:s3:::MyS3BucketARN
SNS Topic ARN	Simple Notification Service > Topics > topic name > Details section	arn:aws:sns:us-east-1:123456789012:MyTopicName
AWS KMS Key ARN	Key Management Service > key alias > General configuration section	arn:aws:kms:us-west-2:123456789012:key/123a4567-890b-1234-c5d6-7ef89012g345
SQS Queue ARN	Simple Queue Service > queue name > Details section	arn:aws:sqs:us-east-1:123456789012:MySQSQueueName
SQS URL	Simple Queue Service > queue name > Details section	https://sqs.us-west-1.amazonaws.com/123456789012/MySQSQueueName
IAM Role ARN	IAM > Access Management > Roles > role name > Summary section	arn:aws:iam::123456789012:role/RoleName (most users will look for the ExpelAssumeRole)

AWS Organization-Specific Values

This chart helps you locate the additional values you need if you are using AWS Organizations. The OU ID is only necessary if you use a single S3 bucket for multiple subsidiaries.

Value	Where to Find	Example
AWS Account ID	AWS Organizations Console, upper right of screen	1234-5678-9012
AWS OU ID	AWS Organizations Console	ou-abc1-defghi2j (format is ou-rootid-ouid and this entire value should be entered into the Workbench security device)

Workbench GUID

The Workbench GUID is a unique alphanumeric value assigned by Expel to your organization.

Format

a123b456-7c89-0def-g1hi-2j3k45l6mn7o

Where to Find

1. Log in to Workbench.
2. Go to Organization Settings > My Organization.
3. On the organization's page, look for the Organization GUID and select the Copy button to copy the GUID.

If you have multiple organizations, you must first select the organization name that will be associated with your integration to access the page with the Copy button. Or, you can stay on the page and highlight then copy the GUID shown for that organization in the GUID column.