Collect AWS Config logs

This document explains how to create a new S3 bucket to store the CloudTrail logs and how to create an IAM user to retrieve the log feeds from AWS. AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.

Before you begin

Ensure you have the following prerequisites:

• Google SecOps instance
• Privileged access to AWS

Configure CloudTrail and AWS S3 bucket

1. Sign in to the AWS Management Console.
2. Go to the Amazon S3 console.
3. In the AWS console, search for Cloudtrail.
4. Click Create trail.
5. Provide a Trail name.
6. Select Create new S3 bucket (you may also choose to use an existing S3 bucket).

7. Provide a name for the AWS KMS alias, or choose an existing AWS KMS Key.

8. Click Next.

9. Choose Event type and add Data events.

10. Click Next.

11. Review the settings and click Create trail.

12. In the AWS console, search for S3 Buckets.

13. Click the newly created log bucket, and select the AWSLogs folder.

14. Click Copy S3 URI and save it.

Configure AWS Config API Calls Logging

1. In AWS, go to AWS Config > Set up AWS Config.
2. Select the bucket type (either select the existing bucket details or create a new one).
3. Select all required AWS-managed rules and click Next to select a bucket.
4. Refer to AWS Config for details on rule types to help you select the appropriate rule based on your requirements:
   • Compliance rules: allow to evaluate the configurations of resources to ensure that they meet compliance standards or regulatory requirements.
   • Configuration rules: allow to evaluate the configurations of resources to ensure that they meet the required configuration standards.
   • Performance rules: allow to evaluate the configurations of resources to ensure that they are optimized for performance.
   • Security rules: allow to evaluate the configurations of resources to ensure that they meet security standards or requirements.
5. Click Create config.
6. Go to Amazon S3.
7. Click the newly created log bucket, and select the folder AWSLogs.
8. Click Copy S3 URI and save it.

Configure AWS IAM User

1. In the AWS console, search for IAM.
2. Click Users.
3. Click Add Users.
4. Provide a name for the user (for example, chronicle-feed-user).
5. Select Access key - Programmatic access as the AWS credential type.
6. Click Next: Permissions.
7. Select Attach existing policies directly.
8. Select AmazonS3ReadOnlyAccess or AmazonS3FullAccess.

1. Click Next: Tags.
2. Optional: Add any tags if required.
3. Click Next: Review.
4. Review the configuration and click Create user.
5. Copy the Access key ID and Secret access key of the created user.

Set up feeds

There are two different entry points to set up feeds in the Google SecOps platform:

• SIEM Settings > Feeds > Add New
• Content Hub > Content Packs > Get Started

How to set up the AWS Config feed

1. Click the Amazon Cloud Platform pack.
2. Locate the AWS Config log type.

3. Specify the values in the following fields.

   • Source Type: Amazon SQS V2
   • Queue Name: The SQS queue name to read from
   • S3 URI: The bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of your S3 bucket.

   • Source deletion options: Select the deletion option according to your ingestion preferences.

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • SQS Queue Access Key ID: An account access key that is a 20-character alphanumeric string.

   • SQS Queue Secret Access Key: An account access key that is a 40-character alphanumeric string.

   Advanced options

   • Feed Name: A prepopulated value that identifies the feed.
   • Asset Namespace: Namespace associated with the feed.
   • Ingestion Labels: Labels applied to all events from this feed.

4. Click Create feed.

For more information about configuring multiple feeds for different log types within this product family, see Configure feeds by product.

UDM Mapping

Need more help? Get answers from Community members and Google SecOps professionals.