Dokumen ini menjelaskan cara menyerap log AWS Key Management Service (KMS) ke Google Security Operations. AWS KMS adalah layanan terkelola sepenuhnya yang memungkinkan Anda membuat dan mengontrol kunci enkripsi yang digunakan untuk mengenkripsi data Anda. Integrasi ini membantu memantau dan mengaudit penggunaan kunci enkripsi.
Sebelum memulai
Pastikan Anda memiliki prasyarat berikut:
Instance Google SecOps
Akses istimewa ke AWS
Mengonfigurasi Amazon S3 dan IAM
Buat bucket Amazon S3 dengan mengikuti panduan pengguna ini: Membuat bucket
Simpan Nama dan Region bucket untuk digunakan nanti.
Di kotak penelusuran, ketik dan pilih CloudTrail dari daftar layanan.
Klik Buat jalur.
Berikan Nama jejak (misalnya, KMS-Activity-Trail).
Centang kotak Aktifkan untuk semua akun di organisasi saya.
Ketik URI bucket S3 yang dibuat sebelumnya (formatnya harus: s3://your-log-bucket-name/), atau buat bucket S3 baru.
Jika SSE-KMS diaktifkan, berikan nama untuk alias AWS KMS, atau pilih Kunci AWS KMS yang ada.
Anda dapat membiarkan setelan lainnya sebagai default.
Klik Berikutnya.
Pilih Peristiwa pengelolaan dan Peristiwa data di bagian Jenis Peristiwa.
Klik Berikutnya.
Tinjau setelan di Tinjau dan buat.
Klik Buat jalur.
Opsional: jika Anda membuat bucket baru, lanjutkan dengan proses berikut:
Buka S3.
Identifikasi dan pilih bucket log yang baru dibuat.
Pilih folder AWSLogs.
Klik Copy S3 URI dan simpan.
Menyiapkan feed
Ada dua titik entri berbeda untuk menyiapkan feed di platform Google SecOps:
Setelan SIEM > Feed > Tambahkan Baru
Hub Konten > Paket Konten > Mulai
Cara menyiapkan feed AWS Key Management Service
Klik paket Amazon Cloud Platform.
Temukan jenis log AWS Key Management Service.
Tentukan nilai di kolom berikut.
Jenis Sumber: Amazon SQS V2
Nama Antrean: Nama antrean SQS yang akan dibaca
URI S3: URI bucket.
s3://your-log-bucket-name/
Ganti your-log-bucket-name dengan nama sebenarnya bucket S3 Anda.
Opsi penghapusan sumber: Pilih opsi penghapusan sesuai dengan preferensi penyerapan Anda.
Usia File Maksimum: Menyertakan file yang diubah dalam beberapa hari terakhir. Defaultnya adalah 180 hari.
ID Kunci Akses Antrean SQS: Kunci akses akun yang berupa string alfanumerik 20 karakter.
Kunci Akses Rahasia Antrean SQS: Kunci akses akun yang berupa string alfanumerik 40 karakter.
Opsi lanjutan
Nama Feed: Nilai yang telah diisi otomatis yang mengidentifikasi feed.
Namespace Aset: Namespace yang terkait dengan feed.
Label Penyerapan: Label yang diterapkan ke semua peristiwa dari feed ini.
Klik Buat feed.
Untuk mengetahui informasi selengkapnya tentang cara mengonfigurasi beberapa feed untuk berbagai jenis log dalam keluarga produk ini, lihat Mengonfigurasi feed menurut produk.
Tabel Pemetaan UDM
Kolom Log
Pemetaan UDM
Logika
data.detail.awsRegion
principal.location.country_or_region
Dipetakan langsung dari kolom data.detail.awsRegion dalam log mentah.
data.detail.eventCategory
security_result.category_details
Dipetakan langsung dari kolom data.detail.eventCategory dalam log mentah.
data.detail.eventName
metadata.product_event_type
Dipetakan langsung dari kolom data.detail.eventName dalam log mentah. Kolom ini menentukan nilai metadata.event_type berdasarkan logika: jika eventName adalah "Decrypt" atau "Encrypt", maka event_type adalah "USER_RESOURCE_ACCESS", jika eventName adalah "GenerateDataKey", maka event_type adalah "USER_RESOURCE_CREATION", jika tidak, event_type adalah "GENERIC_EVENT".
data.detail.requestID
additional.fields.key
Nilai di-hard code ke "requestID" dalam kode parser.
data.detail.requestID
additional.fields.value.string_value
Dipetakan langsung dari kolom data.detail.requestID dalam log mentah.
data.detail.requestParameters.encryptionAlgorithm
security_result.detection_fields.key
Nilai di-hardcode ke "encryptionAlgorithm" dalam kode parser.
data.detail.requestParameters.encryptionAlgorithm
security_result.detection_fields.value
Dipetakan langsung dari kolom data.detail.requestParameters.encryptionAlgorithm dalam log mentah.
data.detail.resources.ARN
target.resource.id
Dipetakan langsung dari kolom data.detail.resources.ARN dalam log mentah.
data.detail.resources.type
target.resource.resource_subtype
Dipetakan langsung dari kolom data.detail.resources.type dalam log mentah.
Dipetakan langsung dari kolom data.detail.userIdentity.sessionContext.sessionIssuer.userName dalam log mentah.
data.detail.userIdentity.type
principal.user.attribute.roles.name
Dipetakan langsung dari kolom data.detail.userIdentity.type dalam log mentah.
data.id
metadata.product_log_id
Dipetakan langsung dari kolom data.id dalam log mentah.
data.time
metadata.event_timestamp.seconds
Nilai detik stempel waktu yang diuraikan dari kolom data.time dalam log mentah.
T/A
metadata.event_type
Kolom ini berasal dari logika parser berdasarkan nilai data.detail.eventName: jika eventName adalah "Decrypt" atau "Encrypt", maka event_type adalah "USER_RESOURCE_ACCESS", jika eventName adalah "GenerateDataKey", maka event_type adalah "USER_RESOURCE_CREATION", jika tidak, event_type adalah "GENERIC_EVENT".
T/A
metadata.log_type
Nilai di-hardcode ke "AWS_KMS" dalam kode parser.
T/A
metadata.product_name
Nilai di-hard code ke "AWS Key Management Service" dalam kode parser.
T/A
metadata.vendor_name
Nilai di-hardcode ke "AMAZON" dalam kode parser.
T/A
principal.asset.attribute.cloud.environment
Nilai di-hardcode ke "AMAZON_WEB_SERVICES" dalam kode parser.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide outlines how to ingest AWS Key Management Service (KMS) logs into Google Security Operations for monitoring and auditing encryption key usage.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves configuring an Amazon S3 bucket and IAM user in AWS, creating a CloudTrail trail for AWS KMS, and setting up a feed in Google SecOps to pull the AWS logs from the S3 bucket.\u003c/p\u003e\n"],["\u003cp\u003eTo set up a feed in Google SecOps, you will need the S3 bucket details (region and URI), along with the access key ID and secret access key of the AWS IAM user with S3 permissions.\u003c/p\u003e\n"],["\u003cp\u003eThe data from the AWS KMS logs are mapped to UDM fields, such as principal location, security result details, product event type, resource identifiers, and user information, among others.\u003c/p\u003e\n"],["\u003cp\u003eThis feature is covered by the Pre-GA Offerings Terms of Google Security Operations Service Specific Terms and may have limited support.\u003c/p\u003e\n"]]],[],null,["# Collect AWS Key Management Service logs\n=======================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest AWS Key Management Service (KMS) logs to Google Security Operations. AWS KMS is a fully managed service that lets you to create and control encryption keys used to encrypt your data. This integration helps in monitoring and auditing the usage of encryption keys.\n\nBefore you begin\n----------------\n\nEnsure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nConfigure Amazon S3 and IAM\n---------------------------\n\n1. Create an **Amazon S3 bucket** following this user guide: [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html)\n2. Save the bucket **Name** and **Region** for later use.\n3. Create a user following this user guide: [Creating an IAM user](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_create.html#id_users_create_console).\n4. Select the created **User**.\n5. Select the **Security credentials** tab.\n6. Click **Create Access Key** in the **Access Keys** section.\n7. Select **Third-party service** as the **Use case**.\n8. Click **Next**.\n9. Optional: add a description tag.\n10. Click **Create access key**.\n11. Click **Download CSV file** to save the **Access Key** and **Secret Access Key** for later use.\n12. Click **Done**.\n13. Select the **Permissions** tab.\n14. Click **Add permissions** in the **Permissions policies** section.\n15. Select **Add permissions**.\n16. Select **Attach policies directly**.\n17. Search for and select the **AmazonS3FullAccess** policy.\n18. Click **Next**.\n19. Click **Add permissions**.\n\nHow to configure CloudTrail for AWS KMS\n---------------------------------------\n\n1. Sign in to the [AWS Management Console](https://aws.amazon.com/console/).\n2. In the search bar, type and select **CloudTrail** from the services list.\n3. Click **Create trail**.\n4. Provide a **Trail name** (for example, **KMS-Activity-Trail**).\n5. Select the **Enable for all accounts in my organization** checkbox.\n6. Type the S3 bucket URI created earlier (the format should be: `s3://your-log-bucket-name/`), or create a new S3 bucket.\n7. If SSE-KMS enabled, provide a name for **AWS KMS alias** , or choose an **existing AWS KMS Key**.\n8. You can leave the other settings as default.\n9. Click **Next**.\n10. Select **Management events** and **Data events** under **Event Types**.\n11. Click **Next**.\n12. Review the settings in **Review and create**.\n13. Click **Create trail**.\n14. Optional: if you created a new bucket, continue with the following process:\n 1. Go to **S3**.\n 2. Identify and select the newly created log bucket.\n 3. Select the folder **AWSLogs**.\n 4. Click **Copy S3 URI** and save it.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the AWS Key Management Service feed\n-------------------------------------------------\n\n1. Click the **Amazon Cloud Platform** pack.\n2. Locate the **AWS Key Management Service** log type.\n3. Specify the values in the following fields.\n\n - **Source Type**: Amazon SQS V2\n - **Queue Name**: The SQS queue name to read from\n - **S3 URI** : The bucket URI.\n - `s3://your-log-bucket-name/`\n - Replace `your-log-bucket-name` with the actual name of your S3 bucket.\n - **Source deletion options**: Select the deletion option according to your ingestion preferences.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Maximum File Age**: Include files modified in the last number of days. Default is 180 days.\n\n - **SQS Queue Access Key ID**: An account access key that is a 20-character alphanumeric string.\n\n - **SQS Queue Secret Access Key**: An account access key that is a 40-character alphanumeric string.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
