AWS CloudFormation Templates for Dropzone Integration

Dropzone provides CloudFormation Templates (CFTs) that assist you in creating the IAM Role you need to integrate with Dropzone. The new role includes a custom trust policy, an AWS-managed ReadOnlyAccess policy, and an inline policy granting specific permissions for secure and streamlined Dropzone operations.

Available CloudFormation Templates

Both create a Custom Trust Policy that ensures secure role assumption by Dropzone, using the provided External ID and User ARN.

Minimum ReadOnly Access Integrations

CloudTrail Permissions:

• Required (Minimum): AWSCloudTrail_ReadOnlyAccess managed policy. This provides the minimum permissions needed for CloudTrail integration. The integration will use the lookup_events API for querying CloudTrail logs.
• Optional (Recommended): cloudtrail:StartQuery permission on event datastores. This enables CloudTrail Lake SQL queries, which provide more powerful querying capabilities. If this permission is not available, the integration will automatically fall back to the lookup_events API. To add this permission, attach a custom policy with:

{
    "Effect": "Allow",
    "Action": "cloudtrail:StartQuery",
    "Resource": "arn:aws:cloudtrail:*:*:eventdatastore/*"
}

EKS Note: AWS does not provide a managed EKS policy. Create a custom policy with eks:ListClusters, eks:DescribeCluster, and other read-only EKS permissions (eks:Describe*, eks:List*) as needed.

Find the Dropzone IAM Role Information

1. Navigate to your Dropzone AI tenant home page e.g. https://_mycompany_.dropzone.app
2. In the bottom left hand corner, click Settings > Integrations
3. Click Available
4. In the search bar, search AWS, then click Configure
5. Under the Connection section, record the ARN and EXTERNAL ID values, for use later in the AWS CloudFormation UI

Running the CloudFormation Template

You will need to repeat these instructions for each account you want to be visible to Dropzone.

1. Log into your AWS account
2. Go to the CloudFormation console, https://console.aws.amazon.com/cloudformation/
3. Click on Create Stack > With new resources (standard)
4. If this is your first stack, then the option will not have With new resources
5. In the Prerequisite - Prepare template section, select Choose an exiting template
6. In the Specify template section, select Amazon S3 URL
7. In the Amazon S3 URL field, input the link to the CFT you've chosen to use (e.g. ReadOnly) from the table at the top of this document
8. Click Next
9. Enter a Stack name, e.g. Dropzone-AI
10. In the Parameters section fill out the information you gathered from the Dropzone UI
11. Click Next
12. On the Configure stack options page click Next
13. On the Review and create page click Submit
14. Once the stack creation is complete, click Outputs
15. Record the RoleARN value shown for use later in the Dropzone UI where it will referred to as Role ARNs
16. If you have additional AWS accounts, repeat the process for each of them

Once done, you may move onto configuring the Dropzone Data and Alert Sources described in the AWS documentation