---
schema_version: "1"
id: 5b98a113702615568d9d4000d9b7601bc0e2fd0d0f2d132a3b1cff86d7b1b0db
title: Configure Resources According to the CloudFormation File
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/platform/264-0-0/platform_o_configure_resources_byos.md
canonical_url: https://help.salesforce.com/s/articleView?id=platform.platform_o_configure_resources_byos.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: f1630a878b641c5dcc8bb6b261fd7f47017eb2fdbdb8ef9b93b4c32a7cab3b1c
description: Use the CloudFormation template to create the resources.
products:
  - Security
  - Salesforce Platform
release: "264"
---
# Configure Resources According to the CloudFormation File

Use the CloudFormation template to create the resources.

1. Access control:
    1. For our application, create the dedicated Role with External ID (OB\_ROLE).
    2. For our application, create the dedicated Audit Role with the same External ID (OB\_AUDIT\_ROLE).
2. Bucket Configuration:
    1. Create a master key in KMS.
    2. Create a bucket for backup data encrypted with KMS.
    3. Create Server Access Logs dedicated to the bucket encrypted with the default key.
    4. Configure bucket events to be sent to Own AWS Account (SQS in OB AWS).
3. Role Policies:
    1. Grant OB\_ROLE permissions to put, list, and delete objects in the bucket.
    2. Grant OB\_AUDIT\_ROLE permissions to retrieve bucket configuration and policies.
    3. The IAM OB tenant is the only user that can assume the OB\_ROLE.
    4. The IAM OB tenant is the only users that can assume the OB\_AUDIT\_ROLE.
4. Bucket Policies:
    1. The OB\_ROLE is the only role with the permission to put, list, and delete objects in the backup bucket.
    2. Access to objects within the backups bucket is only from OB VPC.

Other Bucket Properties & Permissions:

- Public access - OFF.
- Server-side-encryption - ON (AWS managed KMS).
- Versioning - ON.
- Server Access Logging - ON.
- Only Allow SecureTransport HTTPS (TLS V 1.2 and above).
- Lifecycle.
    - Deleted version is removed after 14 days.
    - Move from standard to in-frequent tier after 30 days.
    - Delete objects with tag temp\_storage after 30 days.