...
The document includes the following topics:
Table of Contents | ||||
---|---|---|---|---|
|
Pre-requisites
AWS users should have access to create and , modify the IAM role.
Get assumable role ARN from the Accenture MDR(device onboarding team) to configure it in the cloud formation template ACNMDRAwsAccountARN fieldAWS users should have access to assign a role to EC2 instance (LCP).
Scope
Log Collection within same AWS account (Where LCP and logging resource(s) are in the same AWS account) (Mainly used for MDR self-monitoring)Log Collection using cross AWS account (Where LCP is hosted in MDR SOC AWS account and logging resource is in Customer AWS account)
Note: Logging resources we support are S3 Bucket, SQS, and CloudWatch log
Log Collection within same AWS account (Where LCP and logging resource are in the same AWS account):
Sign in to the AWS Management Console.
Open the AWS Identity and Access Management (IAM) console.
In the navigation pane, choose Roles.
Select Create role
For Select type of trusted entity, choose AWS service and EC2 from Choose a use case
...
6. Click Next: Permissions at the bottom
7. Choose Create policy
8. Choose the JSON tab
9. Type or paste below JSON policy. Make sure you are replacing the resource name.
In case of S3 bucket
Code Block |
---|
{
"Effect": "Allow",
"Action": ["s3:ListBucket","s3:GetObject"],
"Resource": ["arn:aws:s3:::bucketname", "arn:aws:s3:::bucketname/*"],
"Condition": {}
} |
In case of CloudWatch log groups
Code Block |
---|
{
"Effect": "Allow",
"Action": [
"logs:describeLogGroups",
"logs:describeLogStreams",
"logs:filterLogEvents",
"logs:getLogEvents"
],
"Resource": [
"arn:aws:logs:region:accountID:log-group:specificLogGroupName"
]
} |
In case of SQS
{
"Action": [
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:ListQueues"
],
"Effect": "Allow",
"Resource": "arn:aws:sqs:region:accountID:SQSName"
}
Note: In the case of SQS make sure you are creating and attaching the SQS policy as well as the S3 policy to the rule.
10. Click Next: Tags at the bottom.
11. Add a tag to the policy (Optional)
12. Click Next: Review
13. Give the appropriate name to the policy, review it, and Click Create policy.
14. Search the same policy name into the Search text box under Attach permissions policies and select it and Click Next: Tags
...
15. Add a tag to the role (Optional)
16. Give the appropriate name to the Role, review it, and Click Create role.
17. Go back to AWS Management Console.
18. Open the EC2 Dashboard.
19. Go to Instances (running) if the LCP machine is running or else go to Instances, search for LCP instance and start it.
...
21. Search for the IAM role that you have created earlier and click Save.
...
22. Go to the LCP UI and configure the appropriate collector using the below sensor configuration.
...
Property
...
Value
...
Description
...
Secret Access Key
...
na
...
Configure it as ”na”
...
Secret Access ID
...
na
...
Configure it as ”na”
...
Log
...
<Resource Name>
...
Provide S3 bucket name, Log Group Name(s), or SQS URL based on logging source
...
Region
...
<Region>
...
Enter region (E.g.: us-west-2)
...
Logging Source
...
<Select logging Source>
...
Select logging Source from dropdown S3, CloudWatch or SQS
...
Bucket Prefix Path(s)
...
<PrefixPath>
...
Incase of Logging Source as S3
example: /AWSLogs/Account-ID/CloudTrail/region,
...
Collection using cross AWS account (Where LCP is hosted in MDR SOC AWS account and logging resource is in Customer AWS account)
...
Follow these steps:
Configure IAM role in customer AWS account (Account A) with appropriate permissions to the resource (customer side configuration)
Configure IAM role in MDR SOC AWS account (Account B) to access customer resources resource (MDR Side Configuration)
Configure role in customer AWS account (Account A) with appropriate permissions to the resource using CloudFormation (customer side configuration)
Sign in to the AWS Management Console with Account A.
Open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation.
Create a new stack by using one of the following options:
Choose Create Stack This is the only option if you have a currently running stack.
...
b. Choose Create Stack on the Stacks page. This option is visible only if you have no running stacks.
4. Select With new resources (standard) OptionOption
...
5.Create a stack page.
a. On Prerequisite - Prepare template, select Template is ready option
b. On Specify template, select Upload a template file
c. Choose File to select the template file CloudFormationcloudformation.yaml attached below. Once you have chosen your template, CloudFormation uploads the file and displays the S3 URL.
View file | ||
---|---|---|
|
d. Click on Next
...
6. Specify the stack details
a. Type a stack name as per choice.
...
b. Parameters:
CreateNewRole: If
...
role with the name 'ACNMDRCrossAccountRole' does not exist and it needs to be created, select 'Yes'. Otherwise select 'No'
ACNMDRAwsAccountARN: Provide
...
Accenture MDR Account ARN to create cross-account role
ACNMDRExternalId: External ID provided By Accenture MDR for the account. If it is not provided by Accenture MDR, Type External ID as per your choice, ex. <Customer account ID>, Make sure external id matches
...
pattern:
[\w+=,.@:\/-]*
as per the AWS document: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.htmlLoggingResource:
a) S3Bucket:
...
If data is going to be collected directly from S3 Bucket
b) SQS: If SQS is configured for S3
...
Bucket
c) CloudWatchLog: Data collection from Cloud watch log group
PolicyName: It should be a unique policy name that has not been used previously to assign the policy
...
to 'ACNMDRCrossAccountRole'. Recommended PolicyNames - CrossAccountPolicyFor<S3BucketName> or CrossAccountPolicyFor<SQSName> or CrossAccountPolicyFor<LogGroupName>
S3BucketARN: ARN of the S3 bucket from which logs are going to be collected. S3BucketARN is also required if LoggingResource is 'SQS'. Example Values - arn:aws:s3:::<BucketName> or arn:aws:s3:::<BucketName>/<PrefixPath>/. (Note: Keep S3BucketARN blank in case of 'CloudWatchLogs')
SQSOrCloudWatchLogGroupARN: Provide SQS or CloudWatchLogGroup ARN as per LoggingResource selection, SQSOrCloudWatchLogGroupARN required in case of LoggingResource is 'SQS' or 'CloudWatchLogs', (
...
note: Keep SQSOrCloudWatchLogGroupARN blank if LoggingResource is 'S3Bucket')
S3KMSKeyARN: Provide KMS Key ARN used to encrypt S3 Bucket (Note: Value required in case LoggingResource 'S3Bucket' or 'SQS' and s3 Bucket is encrypted)
SQSKMSKeyARN: Provide KMS Key ARN used to encrypt SQS (Note: Value required in case LoggingResource 'SQS' and sqs queue is encrypted)
SQSOrCloudWatchLogKMSKeyARN: Provide KMS Key ARN used to encrypt SQS queue or CloudWatch log group as per selected LoggingResource (Note: Value required in case of LoggingResource is 'SQS' or 'CloudWatchLog' and SQS queue or CloudWatch log group is encrypted)
c. Click on Next
...
7. In the Configure stack option, Add Tags and Permissions required as per the organization standards and nomenclature, or keep it unchanged and click on the Next button.
...
8. On the Review page, review the details of your stack, Please acknowledge the acknowledgment by clicking on the checkbox and then click on Create stack button.
...
9. While your stack is being created, it would appear on the Stacks page with the status as CREATE_IN_PROGRESS, after some time the status will change to CREATE_COMPLETE
10. Once Stack is created, Go to the Outputs tab, copy output values, and share values with Accenture MDR.
...
Note: CloudFormation template will create a new Role with the name "ACNMSSCrossAccountRole" and will attach read-only policies to the role for the resources that need to be monitored, Template also have the option to attach read-only resource policy to the preexisting role with the name "ACNMSSCrossAccountRole"
Below are the resource policies which will get attached to "ACNMSSCrossAccountRole" based on the logging resources selected in the template
Expand | ||
---|---|---|
| ||
|
Expand | ||
---|---|---|
| ||
|
Expand | ||
---|---|---|
| ||
|
...
"Action": [
"sqs:GetQueueAttributes",
"sqs:GetQueueUrl",
"sqs:ReceiveMessage",
"sqs:DeleteMessage",
"sqs:ListQueues"
],
"Effect": "Allow",
...
|
...
Note: In the case of SQS make sure you are creating and attaching SQS policy as well as S3 policy to the rule. |
Configure IAM role in MDR SOC AWS account (Account B) to access customer
...
resource (MDR Side Configuration)
...
Sign in to the AWS Management Console with Account B
Open the IAM console.
From the navigation pane, choose Roles.
Choose to Create role.
For Select the type of trusted entity, choose AWS service.
For Choose the service that will use this role, choose EC2
...
...
Choose Next: Permissions.
...
Choose Next: Tags.
...
You can add optional tags to the role. Or, you can leave the fields blank, and then choose Next: Review.
...
For the Role name, enter a name for the role.
...
Choose to Create role.
...
From the list of roles, choose the role that you just created.
...
Choose to Add inline policy, and then choose the JSON view.
14. Enter the following policy. Replace arn:aws:iam::111111111111:role/ROLENAME with the Role ARN shared by Customer AWS Account (Account A)
Expand | ||
---|---|---|
| ||
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::111111111111:role/ROLENAME" } ] } |
15. Choose Review policy.
16. For Name, enter a name for the policy.
...
23. Go to the LCP UI and configure the appropriate collector using below sensor configuration
Property | Value | Description |
Secret Access ID | <Role ARN> | Configure Role ARN shared by the customer |
Secret Access Key | <External ID> | Configure External id shared between Customer and Accenture |
S3 Bucket/Log Group(s)/SQS Queue URL | <Resource Name> | Provide S3 bucket name, Log Group Name(s), or SQS URL based on logging source |
Region | <Region> | Enter region (Eg: us-west-2) |
Logging Source | <Select logging Source > | Select logging Source from dropdown S3, CloudWatch or SQS |
Bucket Prefix Path(s) | <PrefixPath> | Incase of Logging Source as S3 example: /AWSLogs/Account-ID/CloudTrail/region, |