Jamf Premium Cloud Prerequisites

Technical Articles
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

Jamf Premium Cloud is an add-on for cloud hosting that allows you more control over your server with the following features:

  • Upgrade control

  • IP safelisting

  • Custom DNS/URL

  • Third-party SSL certificates

  • Secure ports

  • Hosting

  • Jamf Log Stream

This technical article describes the prerequisites for certain features, including the information that you must provide to Jamf.

All features included below must be enabled by Jamf Support.

IP Safelisting

  • Provide a list of IP addresses to safelist and blocklist in CIDR format.

  • Provide an outage window that Jamf can use to implement your IP safelisting, and plan for up to 1 hour of outage.

Custom DNS/URL
Jamf Premium Cloud supports custom URLs for both your production and sandbox environments. If you would like to use a custom URL for your Jamf Premium Cloud instance, you can provide your custom URL to Jamf Customer Success and specify whether you would like to use the Jamf built-in certificate authority or your choice of third-party SSL. Once the certificate has been validated, Jamf will create your Jamf Premium Cloud instance. If you would like to use a third-party SSL certificate, see the instructions below.
Third-party SSL Certificates

If you would like to use your choice of third-party SSL certificates instead of the Jamf Pro built-in certificate authority to secure the Jamf Pro web interface, provide the following information:

  • Select the FQDN you want to use and point that domain to your Jamf Cloud instance name as a CNAME record.

  • Obtain the certificate body, host, chain, ROOT, and private key.
    Note:

    The certificate cannot be a wildcard certificate and must be a PEM file.

Jamf Log Stream

Contact Jamf Support to enable Jamf Log Stream and do the following:

  • Specify which logs you would like to stream. JSSAccess and JAMFChangeManagement logs can be streamed.

  • Provide Jamf Support with one of the following:

    • The name of the Amazon S3 bucket you want to forward logs to

    • Your Splunk endpoint URL and authentication token

    • Your Datadog host and API key

    • Your HTTPS endpoint URL

Note:

  • Jamf Log Stream supports on-premise SIEM with Splunk if an HTTPS endpoint is available and signed by a 3rd party SSL certificate. An on-premise SIEM HTTPS endpoint with a self-signed SSL certificate is not supported for Jamf Log Stream.

  • Due to an issue with a third-party plugin, Splunk customers must have the Enable indexer acknowledgment setting disabled.

  • In order to use S3 bucket encrypted with AWS Key Management Service, you must add the IAM role arn:aws: iam::628897759306:role/jamflogs-<fqdn> to your KMS key policy. For assistance or more information, contact Jamf Support.

If you want to stream to an Amazon S3 bucket, assign the following policy to the S3 bucket:
{


"Version": "2012-10-17",
"Id": "PolicyID",
"Statement": [
    {
        "Sid": "StmtID",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::628897759306:role/jamflogs-<fqdn>"
        },
        "Action": [
            "s3:GetBucketLocation",
            "s3:ListBucket", 
            "s3:ListBucketMultipartUploads", 
            "s3:AbortMultipartUpload", 
            "s3:PutObject", 
            "s3:PutObjectAcl", 
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::<bucket-name>",
            "arn:aws:s3:::<bucket-name>/*"
        ]
    }
  ]
}
Note:

Make sure to replace <bucket-name> with your own bucket name provided by Amazon.

Note:

Do not assign this policy until after Jamf Support confirms that log streaming functionality has been enabled for your Jamf Pro instance

The specified logs will begin streaming to your data collection endpoint after your request has been processed and the policy is assigned.

Additional Information

In addition to the features listed above, Jamf Premium Cloud provides support for custom build needs. To discuss possible customizations, contact Jamf.

For more information on Jamf Premium Cloud features, pricing, and availability, see Jamf Premium Cloud.