Dokumen ini menjelaskan cara membuat bucket S3 baru untuk menyimpan log CloudTrail dan cara membuat pengguna IAM untuk mengambil feed log dari AWS.
AWS Config memberikan tampilan mendetail tentang konfigurasi resource AWS di akun AWS Anda. Hal ini mencakup bagaimana hubungan antar-resource dan bagaimana konfigurasi resource tersebut di masa lalu sehingga Anda dapat melihat bagaimana konfigurasi dan hubungan berubah dari waktu ke waktu.
Pilih Buat bucket S3 baru (Anda juga dapat memilih untuk menggunakan bucket S3 yang ada).
Berikan nama untuk alias AWS KMS, atau pilih Kunci AWS KMS yang ada.
Klik Berikutnya.
Pilih Jenis peristiwa dan tambahkan Peristiwa data.
Klik Berikutnya.
Tinjau setelan, lalu klik Buat jejak audit.
Di konsol AWS, cari S3 Buckets.
Klik bucket log yang baru dibuat, lalu pilih folder AWSLogs.
Klik Copy S3 URI dan simpan.
Mengonfigurasi Logging Panggilan API AWS Config
Di AWS, buka AWS Config > Siapkan AWS Config.
Pilih jenis bucket (pilih detail bucket yang ada atau buat bucket baru).
Pilih semua aturan yang dikelola AWS yang diperlukan, lalu klik Berikutnya untuk memilih bucket.
Lihat AWS Config untuk mengetahui detail tentang jenis aturan guna membantu Anda memilih aturan yang sesuai berdasarkan persyaratan Anda:
Aturan kepatuhan: memungkinkan evaluasi konfigurasi resource untuk memastikan bahwa resource tersebut memenuhi standar kepatuhan atau persyaratan peraturan.
Aturan konfigurasi: memungkinkan evaluasi konfigurasi resource untuk memastikan bahwa konfigurasi tersebut memenuhi standar konfigurasi yang diperlukan.
Aturan performa: memungkinkan evaluasi konfigurasi resource untuk memastikan bahwa resource dioptimalkan untuk performa.
Aturan keamanan: memungkinkan evaluasi konfigurasi resource untuk memastikan bahwa resource tersebut memenuhi standar atau persyaratan keamanan.
Klik bucket log yang baru dibuat, lalu pilih folder AWSLogs.
Klik Copy S3 URI dan simpan.
Mengonfigurasi Pengguna IAM AWS
Di konsol AWS, telusuri IAM.
Klik Pengguna.
Klik Tambahkan Pengguna.
Berikan nama untuk pengguna (misalnya, chronicle-feed-user).
Pilih Kunci akses - Akses terprogram sebagai jenis kredensial AWS.
Klik Berikutnya: Izin.
Pilih Lampirkan kebijakan yang ada secara langsung.
Pilih AmazonS3ReadOnlyAccess atau AmazonS3FullAccess.
Klik Berikutnya: Tanda.
Opsional: Tambahkan tag jika diperlukan.
Klik Berikutnya: Tinjau.
Tinjau konfigurasi, lalu klik Buat pengguna.
Salin ID kunci akses dan Kunci akses rahasia pengguna yang dibuat.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
Setelan SIEM > Feed > Tambahkan Baru
Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed AWS Config
Klik paket Amazon Cloud Platform.
Cari jenis log AWS Config.
Tentukan nilai di kolom berikut.
Jenis Sumber: Amazon SQS V2
Nama Antrean: Nama antrean SQS yang akan dibaca
URI S3: URI bucket.
s3://your-log-bucket-name/
Ganti your-log-bucket-name dengan nama sebenarnya bucket S3 Anda.
Opsi penghapusan sumber: Pilih opsi penghapusan sesuai dengan preferensi penyerapan Anda.
Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir. Defaultnya adalah 180 hari.
ID Kunci Akses Antrean SQS: Kunci akses akun yang berupa string alfanumerik 20 karakter.
Kunci Akses Rahasia Antrean SQS: Kunci akses akun yang berupa string alfanumerik 40 karakter.
Opsi lanjutan
Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
Namespace Aset: Namespace yang terkait dengan feed.
Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Pemetaan UDM
Kolom log
Pemetaan UDM
Logika
ARN
target.resource.id
Nilai diambil dari kolom ARN.
awsAccountId
principal.user.userid
Nilai diambil dari kolom awsAccountId.
awsRegion
target.asset.location.country_or_region
Nilai diambil dari kolom awsRegion.
configurationItem.awsAccountId
principal.user.userid
Nilai diambil dari kolom configurationItem.awsAccountId.
configurationItem.configurationItemCaptureTime
target.asset.attribute.creation_time
Nilai diambil dari kolom configurationItem.configurationItemCaptureTime dan dikonversi menjadi stempel waktu.
configurationItem.configurationItemStatus
target.asset.attribute.labels.value
Nilai diambil dari kolom configurationItem.configurationItemStatus. Kuncinya disetel ke "Status Item Konfigurasi".
Nilai diambil dari kolom configurationItem.relationships.resourceType. Kuncinya ditetapkan ke "configurationItem.relationships.resource_types".
configurationItem.resourceId
target.resource.id
Nilai diambil dari kolom configurationItem.resourceId.
configurationItem.resourceType
target.resource.resource_subtype
Nilai diambil dari kolom configurationItem.resourceType.
T/A
metadata.event_type
Jika configurationItemDiff.changeType adalah "UPDATE", metadata.event_type ditetapkan ke "RESOURCE_WRITTEN". Jika configurationItemDiff.changeType adalah "CREATE", metadata.event_type ditetapkan ke "RESOURCE_CREATION". Jika configurationItem.configurationItemStatus adalah "OK" atau "ResourceDiscovered", metadata.event_type ditetapkan ke "RESOURCE_READ". Jika configurationItem.configurationItemStatus adalah "ResourceDeleted", metadata.event_type ditetapkan ke "RESOURCE_DELETION". Jika tidak satu pun kondisi ini terpenuhi, metadata.event_type akan disetel ke "GENERIC_EVENT".
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide explains how to collect AWS Config logs for analysis within Google SecOps, including the creation of an S3 bucket and an IAM user to facilitate log retrieval.\u003c/p\u003e\n"],["\u003cp\u003eAWS Config provides a detailed overview of the configuration, relationships, and historical changes of AWS resources within a user's AWS account.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration involves creating a CloudTrail trail and an S3 bucket to store the logs, and setting up AWS Config to log API calls and applying optional compliance rules.\u003c/p\u003e\n"],["\u003cp\u003eAn IAM user with read access to the S3 bucket must be set up, or full access if Google SecOps will be clearing the buckets, to allow Google SecOps to retrieve logs.\u003c/p\u003e\n"],["\u003cp\u003eThe process concludes with creating and configuring a feed in Google SecOps to ingest AWS Config logs from the designated S3 bucket using the provided IAM user credentials.\u003c/p\u003e\n"]]],[],null,["# Collect AWS Config logs\n=======================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to create a new S3 bucket to store the CloudTrail logs and how to create an IAM user to retrieve the log feeds from AWS.\nAWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.\n\nBefore you begin\n----------------\n\nEnsure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nConfigure CloudTrail and AWS S3 bucket\n--------------------------------------\n\n1. Sign in to the AWS Management Console.\n2. Go to the [Amazon S3 console](https://console.aws.amazon.com/s3/).\n3. In the AWS console, search for **Cloudtrail**.\n4. Click **Create trail**.\n5. Provide a **Trail name**.\n6. Select **Create new S3 bucket** (you may also choose to use an existing S3 bucket).\n7. Provide a name for the **AWS KMS** alias, or choose an existing AWS KMS Key.\n\n | **Note:** Leave the other settings as default.\n8. Click **Next**.\n\n9. Choose **Event type** and add **Data events**.\n\n10. Click **Next**.\n\n11. Review the settings and click **Create trail**.\n\n12. In the AWS console, search for **S3 Buckets**.\n\n13. Click the newly created log bucket, and select the **AWSLogs** folder.\n\n14. Click **Copy S3 URI** and save it.\n\nConfigure AWS Config API Calls Logging\n--------------------------------------\n\n1. In AWS, go to **AWS Config \\\u003e Set up AWS Config**.\n2. Select the bucket type (either select the existing bucket details or create a new one).\n3. Select all required AWS-managed rules and click **Next** to select a bucket.\n4. Refer to [AWS Config](https://docs.aws.amazon.com/pdfs/config/latest/developerguide/config-dg.pdf) for details on rule types to help you select the appropriate rule based on your requirements:\n - **Compliance rules**: allow to evaluate the configurations of resources to ensure that they meet compliance standards or regulatory requirements.\n - **Configuration rules**: allow to evaluate the configurations of resources to ensure that they meet the required configuration standards.\n - **Performance rules**: allow to evaluate the configurations of resources to ensure that they are optimized for performance.\n - **Security rules**: allow to evaluate the configurations of resources to ensure that they meet security standards or requirements.\n5. Click **Create config**.\n6. Go to [Amazon S3](https://console.aws.amazon.com/s3/).\n7. Click the newly created log bucket, and select the folder **AWSLogs**.\n8. Click **Copy S3 URI** and save it.\n\nConfigure AWS IAM User\n----------------------\n\n1. In the AWS console, search for **IAM**.\n2. Click **Users**.\n3. Click **Add Users**.\n4. Provide a name for the user (for example, chronicle-feed-user).\n5. Select **Access key - Programmatic access** as the AWS credential type.\n6. Click **Next: Permissions**.\n7. Select **Attach existing policies directly**.\n8. Select **AmazonS3ReadOnlyAccess** or **AmazonS3FullAccess**.\n\n| **Note:** Use **AmazonS3FullAccess** if Google SecOps needs to clear the S3 buckets after reading logs to optimize AWS S3 storage costs.\n\n1. Click **Next: Tags**.\n2. Optional: Add any tags if required.\n3. Click **Next: Review**.\n4. Review the configuration and click **Create user**.\n5. Copy the Access key ID and Secret access key of the created user.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the AWS Config feed\n---------------------------------\n\n1. Click the **Amazon Cloud Platform** pack.\n2. Locate the **AWS Config** log type.\n3. Specify the values in the following fields.\n\n - **Source Type**: Amazon SQS V2\n - **Queue Name**: The SQS queue name to read from\n - **S3 URI** : The bucket URI.\n - `s3://your-log-bucket-name/`\n - Replace `your-log-bucket-name` with the actual name of your S3 bucket.\n - **Source deletion options**: Select the deletion option according to your ingestion preferences.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Maximum File Age**: Include files modified in the last number of days. Default is 180 days.\n\n - **SQS Queue Access Key ID**: An account access key that is a 20-character alphanumeric string.\n\n - **SQS Queue Secret Access Key**: An account access key that is a 40-character alphanumeric string.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nUDM Mapping\n-----------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
