Skip to main content
Sumo Logic

Configuring your AWS Source with CloudFormation

You can use AWS CloudFormation to leverage AWS products without creating or configuring any AWS infrastructure. With AWS CloudFormation, you declare all of your resources and dependencies in a template file. The template defines a collection of resources as a single unit called a stack. AWS CloudFormation creates and deletes all member resources of the stack together and manages all dependencies between the resources for you.

For more information about AWS CloudFormation, see the AWS CloudFormation Product Page.

Set up an IAM Role

You can grant Sumo Logic access to your AWS Product using an IAM Role with CloudFormation. You can use the AWS Command Line Interface (CLI) or create a stack on the AWS CloudFormation console.

  1. Both methods require a YAML file with the CloudFormation template. You can create a file with the provided YAML template or download a generated template from the Sumo interface when creating your Source by clicking the Generate role-based access template button. The button will only become available after you input the bucket name.

iam role generate cloudformation template in UI.png

Use AWS Command Line Interface (CLI)
  1. Execute the following AWS CLI command to create a stack, see AWS Command Line Reference for create-stack for details.

$ aws cloudformation create-stack --stack-name sumo-role --template-body file://./role-s3bucket --capabilities CAPABILITY_IAM

  1. The role will be created by AWS and named based on the following format:


  1. Copy the Role ARN back to Sumo.
Create a Stack on the AWS CloudFormation console
  1. Visit Services > Cloudformation > Create Stack > Upload a template to Amazon S3 and upload the file with the CloudFormation template and click Next. See Selecting a Stack Template for details.
    upload template when creating cloudformation stack.png

  1. Specify Details. Provide an appropriate Stack Name. Then click Next. See Specifying Stack Name and Parameters for details.

    specify details no params.png
  2. Options can remain default, click Next again. Review and check the box, “I acknowledge that AWS CloudFormation might create IAM resources.” and then click Create.

  3. The role will be created by AWS and named based on the following format:


  4. Copy the Role ARN back to Sumo.

YAML Template to set up an IAM Role

AWSTemplateFormatVersion: '2010-09-09'
Description: A CloudFormation template that creates a role for authenticating with
  Sumo’s AWS integrations.
    Type: String
    Description: An ID used in the trust policy to designate who can assume the role, formatted as deployment:accountId. Eg. us1:0000000000000131
    Type: CommaDelimitedList
    Description: Comma separated list of permissive AWS actions granted to the role. Eg. s3:GetObject,s3:GetObjectVersion,s3:ListBucketVersions,s3:ListBucket
    Type: CommaDelimitedList
    Description: Comma separated ARNs of the AWS resources that the role will have access to. Eg. arn:aws:s3:::mybucket
    Type: AWS::IAM::Role
        Version: '2012-10-17'
        - Effect: Allow
            AWS: arn:aws:iam::926226587429:root
          Action: sts:AssumeRole
                Ref: ExternalID
      Path: "/"
      - PolicyName: SumoPolicy
          Version: '2012-10-17'
          - Effect: Allow
              Ref: Actions
              Ref: Resources