For similar capabilities to Amazon Timestream for LiveAnalytics, consider Amazon Timestream for InfluxDB. It offers simplified data ingestion and single-digit millisecond query response times for real-time analytics. Learn more [here](https://docs.aws.amazon.com/timestream/latest/developerguide/timestream-for-influxdb.html).

# General security
<a name="timestream-for-influx-getting-started-security"></a>

**Topics**
+ [Permissions](#timestream-for-influx-getting-started-security-permissions)
+ [Network access](#timestream-for-influx-getting-started-security-network-access)
+ [Dependencies](#timestream-for-influx-getting-started-security-dependencies)
+ [S3 buckets](#timestream-for-influx-getting-started-security-s3-buckets)

## Permissions
<a name="timestream-for-influx-getting-started-security-permissions"></a>

InfluxDB users should be granted least-privilege permissions. Only tokens granted to specific users, instead of operator tokens, should be used during migration.

Timestream for InfluxDB uses IAM permissions to control user permissions. We recommend users be granted access to the specific actions and resources that they require. For more information, see [Grant least privilege access](https://docs.aws.amazon.com/wellarchitected/2022-03-31/framework/sec_permissions_least_privileges.html). 

## Network access
<a name="timestream-for-influx-getting-started-security-network-access"></a>

The Influx migration script can function locally, migrating data between two InfluxDB instances on the same system, but it is assumed that the primary use case for migrations will be migrating data across the network, either a local or public network. With this comes security considerations. The Influx migration script will, by default, verify TLS certificates for instances with TLS enabled: we recommend that users enable TLS in their InfluxDB instances and do not use the `--skip-verify` option for the script.

We recommend you use an allow-list to restrict network traffic to be from sources you are expecting. You can do this by limiting network traffic to the InfluxDB instances only from known IPs.

## Dependencies
<a name="timestream-for-influx-getting-started-security-dependencies"></a>

The latest major versions of all dependencies should be used, including Influx CLI, InfluxDB, Python, the Requests module, and optional dependencies such as `mountpoint-s3` and `rclone`.

## S3 buckets
<a name="timestream-for-influx-getting-started-security-s3-buckets"></a>

If S3 buckets are used as a temporary storage for migration, we recommend enabling TLS, versioning, and disabling public access.

**Using S3 buckets for migration**

1. Open the AWS Management Console, navigate to **Amazon Simple Storage Service** and then choose **Buckets**.

1. Choose the bucket you wish to use.

1. Choose the **Permissions** tab.

1. Under **Block public access (bucket settings)**, choose **Edit**.

1. Check **Block all public access**.

1. Choose **Save changes**.

1. Under **Bucket policy**, choose **Edit**.

1. Enter the following, replacing *<example-bucket>* with your bucket name, to enforce the use of TLS version 1.2 or later for connections:

------
#### [ JSON ]

****  

   ```
   {
       "Version":"2012-10-17",		 	 	 
       "Statement": [
           {
               "Sid": "EnforceTLSv12orHigher",
               "Principal": {
                   "AWS": "*"
               },
               "Action": [
                   "s3:*"
               ],
               "Effect": "Deny",
               "Resource": [
                   "arn:aws:s3:::<example bucket>/*",
                   "arn:aws:s3:::<example bucket>"
               ],
               "Condition": {
                   "NumericLessThan": {
                       "s3:TlsVersion": 1.2
                   }
               }
           }
       ]
   }
   ```

------

1. Choose **Save changes**.

1. Choose the **Properties** tab.

1. Under **Bucket Versioning**, choose **Edit**.

1. Check **Enable**.

1. Choose **Save changes**.

For information about Amazon S3 bucket best security practices, see [Security best practices for Amazon Simple Storage Service](https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html).

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for Amazon Timestream. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query timestream` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).