{"type":"doc","content":[{"type":"paragraph"},{"type":"paragraph","content":[{"text":"AWS WAF","type":"text","marks":[{"type":"link","attrs":{"href":"https://aws.amazon.com/waf/"}}]},{"text":" is a web application firewall that helps protect your web applications or APIs against common web exploits that may affect availability, compromise security, or consume excessive resources. AWS WAF gives you control over how traffic reaches your applications by enabling you to create security rules that block common attack patterns, such as SQL injection or cross-site scripting, and rules that filter out specific traffic patterns you define. You can get started quickly using Managed Rules for AWS WAF, a pre-configured set of rules managed by AWS or AWS Marketplace Sellers. The Managed Rules for WAF address issues like the OWASP Top 10 security risks. These rules are regularly updated as new issues emerge. AWS WAF includes a full-featured API that you can use to automate the creation, deployment, and maintenance of security rules.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1180,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1180,"id":"ff71266b-e8ca-4fc6-b97c-16a11af7a6b2","collection":"contentId-3519581117","type":"file","height":358}},{"type":"caption","content":[{"text":"How It Works","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}}]}]}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Topics Discussed","type":"text","marks":[{"type":"strong"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"6"},"outline":{"value":"false"},"style":{"value":"none"},"type":{"value":"list"},"printable":{"value":"false"}},"macroMetadata":{"macroId":{"value":"5b476ba7-0035-441c-80c4-5f7fbbea358a"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"39d46fd3-5944-47c0-9b0d-a7225f008bf0"}},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"marks":[{"type":"alignment","attrs":{"align":"center"}}],"content":[{"text":"Benefits","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Agile protection against web attacks","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"AWS WAF rule propagation and updates take under a minute, enabling you to quickly update security across your environment when issues arise. WAF supports hundreds of rules that can inspect any part of the web request with minimal latency impact to incoming traffic. AWS WAF protects web applications from attacks by filtering traffic based on rules that you create. For example, you can filter any part of the web request, such as IP addresses, HTTP headers, HTTP body, or URI strings. This allows you to block common attack patterns, such as SQL injection or cross-site scripting.","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Save time with managed rules","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"With ","type":"text"},{"text":"Managed Rules for AWS WAF","type":"text","marks":[{"type":"link","attrs":{"href":"https://aws.amazon.com/marketplace/solutions/security/waf-managed-rules"}}]},{"text":", you can quickly get started and protect your web application or APIs against common threats. You can select from many rule types, such as ones that address issues like the Open Web Application Security Project (OWASP) Top 10 security risks, threats specific to Content Management Systems (CMS), or emerging Common Vulnerabilities and Exposures (CVE). Managed rules are automatically updated as new issues emerge, so that you can spend more time building applications.","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Improved web traffic visibility","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"AWS WAF gives near real-time visibility into your web traffic, which you can use to create new rules or alerts in Amazon CloudWatch. You have granular control over how the metrics are emitted, allowing you to monitor from the rule level to the entire inbound traffic. In addition, AWS WAF offers comprehensive logging by capturing each inspected web request's full header data for use in security automation, analytics, or auditing purposes.","type":"text"}]}]}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Ease of deployment & maintenance","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"AWS WAF is easy to deploy and protect applications deployed on either Amazon CloudFront as part of your CDN solution, the Application Load Balancer that fronts all your origin servers, Amazon API Gateway for your REST APIs, or AWS AppSync for your GraphQL APIs. There is no additional software to deploy, DNS configuration, SSL/TLS certificate to manage, or need for a reverse proxy setup. With AWS Firewall Manager integration, you can centrally define and manage your rules, and reuse them across all the web applications that you need to protect.","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Cost effective web application protection","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"With AWS WAF you pay only for what you use. AWS WAF provides a customizable, self-service offering, and pricing is based on how many rules you deploy and how many web requests your web application receives. There are no minimum fees and no upfront commitments.","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":33.33},"content":[{"type":"paragraph","content":[{"text":"Security integrated with how you develop applications","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff991f"}},{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Every feature in AWS WAF can be configured using either the AWS WAF API or the AWS Management Console. This allows your DevOps team to define application-specific rules that increase web security as they develop applications. This lets you put web security at multiple points in the development process chain, from the hands of the developer initially writing code, to the DevOps engineer deploying software, to the security administrators enforcing a set of rules across the organization.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Obtain Log Relay for Remote Log Collection"},"name":{"value":"Remote Log Collection Permissions"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"d7f92f93-d750-4655-b2a9-5e3da003bf15"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"7c5971b4-98aa-4bfd-8c42-f5bf0cd8adfa"}}]},{"type":"paragraph","content":[{"text":"You can use this document to collect and send AWS WAF Classic logs to Armor's Security Information & Event Management (SIEM).","type":"text"}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"Pre-deployment-considerations"},"legacyAnchorId":{"value":"AWSWAF-Pre-deployment-considerations"}},"macroMetadata":{"macroId":{"value":"9e26271fb2c371f608e215541f873e4d"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"712a198c-04f0-441a-a8f6-7ba83e7b8e09"}},{"text":"Pre-Deployment Considerations","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Before you begin, review the following requirements:","type":"text"}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"AMP Permissions","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Virtual Machine","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Management","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Endpoints","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Write Log Relays","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete Log Relays","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"To learn more about permissions in AMP, see ","type":"text"},{"text":"Roles and Permissions","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519587062"}}]},{"text":".","type":"text"}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Log Relay","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"For remote log collection, you must have a Log Relay server on your account. ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to add Log Relay to your account, see ","type":"text"},{"text":"Obtain Log Relay for Remote Log Collection","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519581253"}}]},{"text":".","type":"text"}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"AWS Account Permissions (Policies)","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AWS WAF","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AWS Lambda","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AWS CloudWatch","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AWS CloudFormation","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]}]},{"type":"paragraph","content":[{"type":"hardBreak"},{"text":"Web ACL","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"To ingest logs from an AWS WAF, you must first configure a ","type":"text"},{"text":"Web ACL","type":"text","marks":[{"type":"strong"}]},{"text":". ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To learn how to create a ","type":"text"},{"text":"Web ACL","type":"text","marks":[{"type":"strong"}]},{"text":", see ","type":"text"},{"text":"AWS's documentation site","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl.html"}}]},{"text":".","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"Armor does not provide support for using AWS CloudFormation to set up AWS WAF resources in AWS GovCloud (US).","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Configure The AWS WAF CloudFormation Stack Template","type":"text"}]},{"type":"rule"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login into the AWS console.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to the ","type":"text"},{"text":"CloudFormation","type":"text","marks":[{"type":"strong"}]},{"text":" service.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Create stack","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"expand","attrs":{"title":"Instructions - Click to Expand"},"content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"AWS is in the process of updating the screens in their AWS console. As a result, there are two versions of the AWS CloudFormation screen.","type":"text"}]},{"type":"paragraph","content":[{"text":"Review the following table to understand your particular view, and then review the appropriate option.","type":"text"}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1092,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1377,"alt":"2-20240312-170631.webp","id":"72345a85-b15a-4f27-aa60-1eb8371b3cf7","collection":"contentId-3519581117","type":"file","height":776}}]},{"type":"paragraph","content":[{"text":"In the AWS console, in the top menu, on the right side, select the desired region for log collection.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"

The CloudFormation template must be executed in the same region as the Web ACL.

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"The CloudFormation template must be executed in the same region as the Web ACL.","type":"text"}]}]}],"version":1},"reason":"A note macro in a list item can't be created or edited in the new editor."}}}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1344,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1852,"alt":"7-20240312-170715.webp","id":"26115299-4b6c-4ff9-a8f4-8b1ae77005de","collection":"contentId-3519581117","type":"file","height":851}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Amazon S3 URL","type":"text","marks":[{"type":"strong"}]},{"text":", input the following link: ","type":"text"},{"text":"https://s3-us-west-2.amazonaws.com/logs.armor.com/log-relay-aws-waf/log-relay-aws-waf.yaml","type":"text","marks":[{"type":"link","attrs":{"href":"https://s3-us-west-2.amazonaws.com/logs.armor.com/log-relay-aws-waf/log-relay-aws-waf.yaml"}}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1344,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1377,"alt":"8-20240312-170721.webp","id":"c0d07d93-dcee-4841-ad29-f916a02a032f","collection":"contentId-3519581117","type":"file","height":776}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Next","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"Stack","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"name","type":"text","marks":[{"type":"strong"}]},{"text":", enter a descriptive name.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This name must begin with a letter, and can only contain letters, numbers, and hyphens.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"ArmorLogEndpoint,","type":"text","marks":[{"type":"strong"}]},{"text":" enter the URL (including protocol and port number) of the endpoint to which logs will be sent.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This is the IP address or DNS name of the log relay instance, using the https protocol and port 5443.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"ArmorTenantId","type":"text","marks":[{"type":"strong"}]},{"text":", enter your Armor account number.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This can be found in the ","type":"text"},{"text":"Account","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"Overview","type":"text","marks":[{"type":"strong"}]},{"text":" section of your AMP account.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"BucketName","type":"text","marks":[{"type":"strong"}]},{"text":", enter your S3 bucket name. This must be globally unique and bucket name should start with ‘aws-waf-logs’.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"This is the S3 bucket (name) created by the CloudFormation template.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"BucketRetentionInDays","type":"text","marks":[{"type":"strong"}]},{"text":", enter the number of days logs are retained in the S3 bucket. ","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"By default, Armor has configured 3 days; set to 0 to keep logs until manually removed.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]},{"text":"StrictSsl","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}},{"type":"strong"}]},{"text":", indicate whether or not strict SSL checks should be enforced on the destination log URL (True or False).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Armor recommends that ","type":"text"},{"text":"StrictSsl ","type":"text","marks":[{"type":"strong"}]},{"text":"be set to True. Afterwards, you must complete the","type":"text"},{"text":" steps to enable SSL","type":"text","marks":[{"type":"strong"}]},{"text":" to utilize the CloudFormation template. If these steps are not performed, when you attempt to launch the newly created CloudFormation template, the process will fail.","type":"text"}]},{"type":"paragraph","content":[{"text":"Steps to enable SSL","type":"text","marks":[{"type":"link","attrs":{"href":"#steps-to-enable-ssl"}}]}]}]},{"type":"orderedList","attrs":{"order":11},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In ","type":"text"},{"text":"WebAclId","type":"text","marks":[{"type":"strong"}]},{"text":", enter the ID of the AWS WAF Web ACL.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1406,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1864,"alt":"image-20240603-093623.png","id":"2db2143f-63f4-43de-9f4c-e796f20da9f2","collection":"contentId-3519581117","type":"file","height":848}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Next","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) If required by your organization, under ","type":"text"},{"text":"Tags","type":"text","marks":[{"type":"strong"}]},{"text":", add your organization's tags to the CloudFormation deployment.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"(Optional) If required by your organization, under ","type":"text"},{"text":"Permissions","type":"text","marks":[{"type":"strong"}]},{"text":", in the drop-down menu, select ","type":"text"},{"text":"IAM","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"role","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"ARN","type":"text","marks":[{"type":"strong"}]},{"text":", and then in the corresponding field, enter ","type":"text"},{"text":"AWSCloudFormationStackSetExecutionRole","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":1344,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1377,"alt":"10-20240312-170735.webp","id":"0f7f17b3-00d4-4f96-b294-173f76ff6973","collection":"contentId-3519581117","type":"file","height":1125}}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Review the information for the stack.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"At the bottom of the screen, mark the box to accept the terms, and then click ","type":"text"},{"text":"Create stack","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"After a few minutes, the stack status should change from CREATE_IN_PROGRESS to CREATE_COMPLETE.","type":"text"}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"If you want to upgrade the existing AWS WAF CloudFormation, please delete the existing template and use the new CloudFormation template.","type":"text"}]}]},{"type":"paragraph"}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Verify Connection in AMP","type":"text","marks":[{"type":"strong"}]}]},{"type":"rule"},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the Armor Management Portal (AMP), in the left-side navigation, click ","type":"text"},{"text":"Security","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click ","type":"text"},{"text":"Log & Data Management","type":"text","marks":[{"type":"strong"}]},{"text":", and then select ","type":"text"},{"text":"Search","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"Source","type":"text","marks":[{"type":"strong"}]},{"text":" column, review the source name to locate the newly created AWS WAF remote log source.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the search field, you can also enter \"webaclid\" to locate AWS WAF messages.","type":"text"}]}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Troubleshooting","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"If you are having issues adding a remote collector to an AWS WAF remote device, consider that:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You do not have proper permissions in AWS.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"You entered the AWS account information for an incorrect AWS service account.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"If you have multiple AWS accounts, especially child or organization accounts, you must verify that you added the service account information for the correct service account","type":"text"}]}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"hardBreak"},{"text":"Edit a Stack","type":"text"}]},{"type":"rule"},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This section only applies to single stacks, not stack sets.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Currently, Armor's AWS CloudFormation template does not support updates. If you want to update your stack, then you must delete the remote log source, and then create a new one with your desired updates. ","type":"text"}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"steps-to-enable-ssl"},"legacyAnchorId":{"value":"AWSWAF-steps-to-enable-ssl"}},"macroMetadata":{"macroId":{"value":"e3bd146b6869bbc7a42697c80c58e7f8"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"556e550e-2f27-45eb-9838-869126a3d2a2"}},{"text":"Steps To Enable SSL","type":"text"}]},{"type":"expand","attrs":{"title":"Click Here To Expand..."},"content":[{"type":"paragraph","content":[{"text":"SSL/TLS Secured Communications","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"In most cases, we assume network isolation using subnetting and/or firewalls are in place to secure communication between a log source and your Log Relay. There are a few exceptions to this assumption:","type":"text"}]},{"type":"paragraph","content":[{"text":"In scenarios where it is typical to have data traverse the Internet, or in scenarios where a device ","type":"text"},{"text":"only","type":"text","marks":[{"type":"em"}]},{"text":" supports TLS-secured transport, the Log Relay config supports TLS ingestion.","type":"text"}]},{"type":"paragraph","content":[{"text":"Certificates","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"When you install the Log Relay software, a self-signed certificate and its corresponding private key are generated and placed in ","type":"text"},{"text":"/opt/armor/logrelay.pem","type":"text","marks":[{"type":"strong"}]},{"text":" and ","type":"text"},{"text":"/opt/armor/logrelay.key","type":"text","marks":[{"type":"strong"}]},{"text":" respectively. If the device sending logs requires strict SSL checks, you have a few options to satisfy this requirement:","type":"text"}]},{"type":"paragraph","content":[{"text":"Exporting the Self-Signed Certificate","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"You may export the certificate and add it to the trust store of the log source device (if supported). You copy the PEM certificate from the Log Relay server and then consult the vendor-supplied documentation to install a new trusted certificate.","type":"text"}]},{"type":"paragraph","content":[{"text":"Using a Certificate from a Valid CA","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"You can also generate a CSR and request a certificate from a CA the log source device already trusts. Using ","type":"text"},{"text":"openssl","type":"text","marks":[{"type":"link","attrs":{"href":"http://100.64.215.25/"}}]},{"text":" you can generate a new CSR. We recommend using a configuration file to supply Subject Alternate Names (SANs) for the various DNS hostnames pointed at your Log Relay in addition to its IP address.","type":"text"}]},{"type":"paragraph","content":[{"text":"logrealy.cnf","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","content":[{"text":"[ req ]\ndefault_bits = 2048\ndistinguished_name = req_distinguished_name\nreq_extensions = req_ext\n\n[ req_distinguished_name ]\ncountryName = \nstateOrProvinceName = \nlocalityName = \norganizationName = \ncommonName = \n\n[ req_ext ]\nsubjectAltName = @alt_names\n\n[alt_names]\nDNS.1 = \nDNS.2 = \nDNS.3 = ","type":"text"}]},{"type":"paragraph","content":[{"text":"Fill in the values in angle brackets above with applicable values. For <","type":"text"},{"text":"COUNTRY","type":"text","marks":[{"type":"strong"}]},{"text":"> us the 2-digit ISO country code. For <","type":"text"},{"text":"STATE","type":"text","marks":[{"type":"strong"}]},{"text":">. you can use the 2-digit abbreviation or the full name of your state or province.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the IP address of the Log Relay changes frequently or you already use a DNS hostname as the ","type":"text"},{"text":"default","type":"text","marks":[{"type":"em"}]},{"text":" means of addressing the Log Relay, use the DNS hostname instead of the IP address in <","type":"text"},{"text":"LOG_RELAY_IP_ADDRESS","type":"text","marks":[{"type":"strong"}]},{"text":">.","type":"text"}]},{"type":"paragraph","content":[{"text":"Add any DNS hostnames that resolve to this Log Relay using the ","type":"text"},{"text":"alt_names","type":"text","marks":[{"type":"strong"}]},{"text":" section of the config. If you're not using any SANs, remove the [","type":"text"},{"text":"alt_names","type":"text","marks":[{"type":"strong"}]},{"text":"] and [","type":"text"},{"text":"req_ext","type":"text","marks":[{"type":"strong"}]},{"text":"] sections and remove the","type":"text"},{"type":"hardBreak"},{"text":"reference under the [","type":"text"},{"text":"req","type":"text","marks":[{"type":"strong"}]},{"text":"] section.","type":"text"}]},{"type":"paragraph","content":[{"text":"Then use ","type":"text"},{"text":"openssl ","type":"text","marks":[{"type":"strong"}]},{"text":"to request the certificate:","type":"text"}]},{"type":"codeBlock","content":[{"text":"openssl req -new rsa:2048 -key /opt/armor/logrelay.key -nodes -out logrelay.csr -config logrelay.cnf","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that you may need to run this command as root as the key is owned by the Log Relay service account.","type":"text"}]},{"type":"paragraph","content":[{"text":"After you've generated your CSR and received the certificate from the CA, ensure that it is in PEM format and upload it to your Log Relay machine. Ensure that is accessible to the Log Relay service account.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the file is uploaded and has the correct permissions, update the override environment file to point at the path of the new certificate. Create a file at ","type":"text"},{"text":"/etc/sysconfig/armor-logstash.override ","type":"text","marks":[{"type":"strong"}]},{"text":"with the following contents:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ARMOR_LOGSTASH_SSL_CERT='/path/to/cert.pem'","type":"text"}]},{"type":"paragraph","content":[{"text":"If you used a key other than the one included with the Log Relay, you can specify it in this file as well:","type":"text"}]},{"type":"codeBlock","content":[{"text":"ARMOR_LOGSTASH_SSL_KEY='/path/to/private.key'","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this key must not have a password and be in PKCS8 format. You can use file permissions and/or selinux policies to protect the key.","type":"text"}]},{"type":"paragraph","content":[{"text":"After creating or updating these configuration files, restart the Log Relay service:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo systemctl restart armor-logstash.service","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported