...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
...
| Note |
|---|
In your AWS account, you must have read privileges for AWS S3 buckets and AWS CloudTrail. |
You can use this document to add a remote log collector to a AWS CloudTrail remote device (log source).
Pre-Deployment Considerations
...
AWS Account Information
- Access your AWS console.
- In the top, right corner, locate and copy your account number and corresponding region. You will need this information later.
...
- In the Armor Management Portal (AMP), in the left-side navigation, click Security.
- Click Log & Data Management.
- Click External Sources.
- Click the plus ( + ) sign.
- If you do not have any log sources already created, then click Add a New Log Source.
- Complete the missing fields:
- In Endpoint, select the available Armor Endpoint.
- In Log Source Type, select Amazon AWS CloudTrail.
- In Log Source Identifier, confirm that the listed system hostname matches the system for log collection.
- This field will populate after you complete the Account Number field.
- In Protocol, confirm that Amazon AWS S3 REST API is selected.
- In Account Number, paste the AWS account number that you copied early. You must remove any dashes or hyphens ( - ).
- In Region to Monitor, select the region that corresponds to the account number.
- Click Save Log Source.
- In the pop-up window, copy and paste the URL text. You will need this information in the AWS console.
- Click Return to the Log Source List. You will be redirected to the External Sources screen.
- In the External Sources screen, refresh the screen until the log source reaches an Online status.
...
- In the Armor Management Portal (AMP), in the left-side navigation, click Security.
- Click Log & Data Management, and then select External Sources.
- Locate the newly created remote log source.
- Under Last Event, verify that a recent activity took place.
- This status will indicate that the configurations were successful.
- After you update your AWS account, it may take 30 minutes for AMP to display the updates.
Additionally, you can view the actual logs to confirm that the configuration was successful.
- In the Armor Management Portal (AMP), in the left-side navigation, click Security.
- Click Log & Data Management, and then select Search.
- In the search field, enter your AWS account number surrounded by asterisks wildcards.
- For example, you can enter *123456789123*
- This action will display collected AWS CloudTrail logs.
| Info |
|---|
TroubleshootingIf you are having issues adding a remote log collector to an AWS CloudTrail remote device, consider that:
|
...
Benefits
Simplified compliance
With AWS CloudTrail, simplify your compliance audits by automatically recording and storing event logs for actions made within your AWS account. Integration with Amazon CloudWatch Logs provides a convenient way to search through log data, identify out-of-compliance events, accelerate incident investigations, and expedite responses to auditor requests.
Visibility into user and resource activity
AWS CloudTrail increases visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.
Security analysis and troubleshooting
With AWS CloudTrail, you can discover and troubleshoot security and operational issues by capturing a comprehensive history of changes that occurred in your AWS account within a specified period of time.
Security automation
AWS CloudTrail allows you track and automatically respond to account activity threatening the security of your AWS resources. With Amazon CloudWatch Events integration, you can define workflows that execute when events that can result in security vulnerabilities are detected. For example, you can create a workflow to add a specific policy to an Amazon S3 bucket when CloudTrail logs an API call that makes that bucket public.
Topics Discussed
| Table of Contents | ||||
|---|---|---|---|---|
|
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. In addition, you can use CloudTrail to detect unusual activity in your AWS accounts. These capabilities help simplify operational analysis and troubleshooting.
How It Works
...