Keep copies of collected logs and other add-in data in Amazon S3, set up by signing in to AWS from the firewall. No keys to copy:

You approve the sign-in in your own browser with your AWS login and MFA.
You pick the account, bucket, and folder from lists.
Korthveil creates its own AWS user that may only use that folder.

You need:

AWS IAM Identity Center turned on for your AWS organization or account (AWS console › IAM Identity Center);
your user in Identity Center with a permission set in the target account that may manage S3 and IAM, such as AdministratorAccess (only for the setup; the firewall keeps a far smaller key);
about 5 minutes.

How it works

 your browser                      Korthveil firewall                         AWS
 ┌──────────────────┐  code     ┌──────────────────────────┐  sign-in   ┌───────────────────────────┐
 │ approve the code │ ◀──────── │ 1 sign in (device code)  │ ─────────▶ │ IAM Identity Center       │
 │ (AWS login, MFA) │           │ 2 list accounts, roles   │            │ S3: buckets, folders      │
 └──────────────────┘           │ 3 bucket, folder         │ ─────────▶ │ IAM: user korthveil-...   │
                                │ 4 create its own user    │            │  policy: this folder only │
                                │   and key; test it       │            └───────────────────────────┘
                                │ 5 sign out               │
                                └──────────────────────────┘

What the firewall keeps from your sign-in: nothing.

The sign-in and the role's short-lived credentials stay in the firewall's memory only.
They are forgotten when you finish, sign out, or after an hour without use.
The configuration holds only the new user's key, which may list, write, read, and delete files in the chosen folder and nothing else.

Step 1: Find your access portal URL

In the AWS console, open IAM Identity Center › Settings. Note the AWS access portal URL (for example https://d-1234567890.awsapps.com/start) and the Region shown on the same page.

Go to System › Network storage, panel Amazon S3 archive, tab Sign in with AWS (recommended):

AWS access portal URL: the URL from step 1;
Identity Center region: the region from step 1.

Click Sign in with AWS.

The firewall shows a code. Click Open AWS sign-in, sign in as usual (with MFA), and check that the page shows the same code before you click Confirm and continue and Allow. The firewall notices within a few seconds.

Only approve codes you started yourself: anyone who approves a code gives that firewall their access.

Step 3: Choose the account and role

Choose the AWS account that should hold the archive, and a role (permission set) that may manage S3 and IAM.

Step 4: Choose or create the bucket

The list shows every bucket of the account with its region.

Choose one, or
create a bucket: the name must be unique across all of AWS, so add something of your own (for example example-corp-firewall-archive). Choose the region, and keep Keep earlier versions on, so an overwritten or deleted archive can be recovered.

New buckets are private (all public access blocked) and encrypted (SSE-S3).

Step 5: Choose the folder

Browse into the bucket.

Use an existing folder, or
make a new one: type its name and Create and open. The firewall's host name is suggested.

The key the firewall gets may use this folder and nothing else.

Step 6: Set up the archive

Name: names the destination (s3-<name>) and the schedule (archive-<name>).
Encryption by S3: SSE-S3, or SSE-KMS with your key.
Every: how often new data is copied.
Archive passphrase: the firewall encrypts every archive with it before upload (AES-256-GCM). Keep it safe: you need it to restore.
Add-in data: which add-ins' data is archived, for example syslog-server for collected logs.

Click Finish. The firewall:

creates the AWS user korthveil-<firewall>-<name> (path /korthveil/, tagged with the firewall's name);
gives it a policy for this bucket folder only, and an access key;
writes and deletes a test file to check the key works;
adds the destination and schedule to pending changes;
signs you out of AWS.

Step 7: Commit and test

Commit the pending changes. Then, under System › Schedules & delivery:

Test connection on the destination;
Run now on the schedule.

The first archive appears in the folder in S3. Restore archives under System › Backup & restore.

Later

To	Do
Replace the key	Run the setup again with the same name. The firewall makes a new key. The previous one keeps working until you commit; delete it afterwards in AWS (IAM › Users › korthveil-… › Security credentials).
Stop archiving	Delete the schedule and destination, commit, then delete the IAM user `korthveil-…` in AWS.
Keep archives longer or cheaper	In S3, add a lifecycle rule to the folder (for example to Glacier after 90 days). The firewall only adds files.
Use keys you already have	Tab Enter access keys in the same panel.

Troubleshooting

Symptom	Check
"the start URL is your AWS access portal address"	Copy the AWS access portal URL exactly from IAM Identity Center › Settings.
The code page says the code is invalid or expired	Codes last 10 minutes. Click Cancel and sign in again.
"AWS refused: the chosen role may not do this"	The permission set needs S3 (list, create bucket) and IAM (create user, put user policy, create access key). Choose another role, or ask your AWS administrator.
"that bucket name is taken"	Bucket names are global across AWS. Choose another.
"the new key could not write to the folder"	A bucket policy or an SCP may deny the new user. Check the bucket's policy and your organization's SCPs.
Nothing happens after approving	The firewall must reach `oidc.<region>.amazonaws.com`, `portal.sso.<region>.amazonaws.com`, `iam.amazonaws.com`, and `s3.amazonaws.com` over HTTPS. With outbound filtering on (Firewall › Outbound), allow them during the setup.

More: adr/0066 describes the design and its security; adr/0049 describes the archives.