> Source: [sk117581](https://support.checkpoint.com/results/sk/sk117581)

# sk117581 - Accessing S3 objects from Check Point instances running in AWS

| Property | Value |
|----------|-------|
| Solution ID | sk117581 |
| Date Created | 2017-05-24 |
| Last Modified | 2024-05-05 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R81 (EOS), R81.10 (EOS), R81.20 |
| Platform | AWS |

## Solution

**Amazon Simple Storage Service (S3)** is an object storage service provided by Amazon Web Services (AWS).   
More information on S3 can be found on the [Amazon S3 site](https://aws.amazon.com/s3/).

You can use a simple CLI tool to securely upload and download S3 objects on Check Point instances. One use case for this is to archive Check Point log files in S3.

**Examples**:

* To create a new bucket named BUCKET:   
  **`# s3 /BUCKET ''`**   

* To upload a file named FILE into an existing bucket named BUCKET as an object named OBJECT:  
  **# s3 /BUCKET/OBJECT @FILE**  

* To upload a file named FILE into an existing bucket named BUCKET as an object named OBJECT and make the object public:  
  **# s3 --public /BUCKET/OBJECT @FILE**  

* To upload content from standard input into an existing bucket named BUCKET as an object named OBJECT:  
  **# s3 /BUCKET/OBJECT @-**  

* To list objects in a bucket named BUCKET:  
  **# s3 /BUCKET/**  

* To download an object named OBJECT from a bucket named BUCKET into a file named FILE:  
  **# s3 /BUCKET/OBJECT > FILE**  

* To delete an object named OBJECT from a bucket named BUCKET:   
  **# s3 /BUCKET/OBJECT -**  

* To delete a bucket named BUCKET:   
  **# s3 /BUCKET -**  

* To view complete usage:   
  **# s3 -h**

### Region

The S3 region can be specified on the command line using:  
**--region REGION**

Alternatively, set the region through the **`AWS_DEFAULT_REGION`** environment variable. If no region is supplied through CLI or the environment it defaults to **`us-east-1`**.

### Authentication

The tool requires a set of AWS credentials with the necessary permissions to carry out the required operation.   
The tool supports two types of credentials:

* Instance profile credentials
* API Keys

### Authentication using an Instance profile

1. Create an instance profile with permissions to access the required S3 resources.
2. Assign the instance profile to your instance.
3. When using the CLI, specify the **`--iam`** option  
   Example:   
   to download a file, use:   
   **# s3 --iam /BUCKET/OBJECT > FILE**

### Authentication using API keys

1. Create API keys with necessary permissions to access the required S3 resources.
2. Before launching the CLI, set the following environment variables:  
   **# export AWS_ACCESS_KEY_ID=...**  
   **# export AWS_SECRET_ACCESS_KEY=...
   *NOTE : Authentication using temporary API keys must add to above commands
   # export AWS_SESSION_TOKEN=...**
3. Launch the CLI as explained above.

### Server Side Encryption

To upload a file and have it encrypted on the server side with an AWS KMS key, specify the KMS key ARN on the command line using:

**--kms-key-id KMS-KEY-ARN**

<br />

Example:

**# s3 --kms-key-id arn:aws:kms:... /BUCKET/OBJECT @FILE**

When downloading a server side encrypted file, the file will be downloaded decrypted and there is no need to specify a KMS key.

### Proxy

If access to S3 needs to go through a proxy, set the following environment variables:  

**# export http_proxy=http://PROXY-ADDRESS:PROXY-PORT**  
**# export https_proxy=http://PROXY-ADDRESS:PROXY-PORT**  

Make sure to set both the**http_proxy** and**https_proxy** environment variables.

<br />

**Notes**:

* Uploaded objects that are larger than 5 megabytes are uploaded using a multipart upload.
* When objects are downloaded, they are transferred over a single connection and stored entirely in memory before being written to **`stdout`**. This limits the practical size of an object for download to no more than a few hundreds of megabytes.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content