...
AWS users should have access to create, modify the IAM role.AWS users should have access to assign a role to EC2 instance (LCP)
Get assumable role ARN from the Accenture MDR(device onboarding team) to configure it in the cloud formation template ACNMDRAwsAccountARN field.
Scope
Log Collection using cross AWS account (Where LCP is hosted in MDR SOC AWS account and logging resource is in Customer AWS account)
...
c. Choose File to select the template file CloudFormationcloudformation.yaml attached below. Once you have chosen your template, CloudFormation uploads the file and displays the S3 URL.
...
b. Parameters:
CreateNewRole: If a role with the name 'ACNMDRCrossAccountRole' does not exist and it needs to be created, select 'Yes'. Otherwise select 'No'
ACNMDRAwsAccountARN: Provide Accenture MDR Account ARN to create cross-account roleassumable role ARN collected from the Accenture MDR device onboarding team(Accenture MDR assumable role will be used to create trust relation with customer role)
ACNMDRExternalId: Provide an External ID provided By Accenture MDR for the account. If it is not provided by Accenture MDR, Type External ID as per your choice, ex. <Customer account ID>, Make sure external id matches the pattern:
[\w+=,.@:\/-]*as per the AWS document: https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.htmlLoggingResource:
...
PolicyName: It should be a unique policy name that has not been used previously to assign the policy to 'ACNMDRCrossAccountRole'. Recommended PolicyNames - CrossAccountPolicyFor<S3BucketName> or CrossAccountPolicyFor<SQSName> or CrossAccountPolicyFor<LogGroupName>
S3BucketARN: ARN of the S3 bucket from which logs are going to be collected. S3BucketARN is also required if LoggingResource is 'SQS'. Example Values - arn:aws:s3:::<BucketName> or arn:aws:s3:::<BucketName>/<PrefixPath>/. (Note: Keep S3BucketARN blank in case of 'CloudWatchLogs')
SQSOrCloudWatchLogGroupARN: Provide SQS or CloudWatchLogGroup ARN as per LoggingResource selection, SQSOrCloudWatchLogGroupARN required in case of LoggingResource is 'SQS' or 'CloudWatchLogs', (note: Keep SQSOrCloudWatchLogGroupARN blank if LoggingResource is 'S3Bucket')
S3KMSKeyARN: Provide KMS Key ARN used to encrypt S3 Bucket (Note: Value required in case LoggingResource 'S3Bucket' or 'SQS' and s3 Bucket is encrypted)
SQSKMSKeyARN: Provide KMS Key ARN used to encrypt SQS (Note: Value required in case LoggingResource 'SQS' and sqs queue is encrypted)
SQSOrCloudWatchLogKMSKeyARN: Provide KMS Key ARN used to encrypt SQS queue or CloudWatch log group as per selected LoggingResource (Note: Value required in case of LoggingResource is 'SQS' or 'CloudWatchLog' and SQS queue or CloudWatch log group is encrypted)
c. Click on Next
...
8. On the Review page, review the details of your stack, Please acknowledge the acknowledgment by clicking on the checkbox and click on Create stack button.
...
...
9. While your stack is being created, it would appear on the Stacks page with the status as CREATE_IN_PROGRESS, after some time the status will change to CREATE_COMPLETE
...
| Expand | ||
|---|---|---|
| ||
Note: In the case of SQS make sure you are creating and attaching SQS policy as well as S3 policy to the rule. |
Configure IAM role in MDR SOC AWS account (Account B) to access customer
...
resources (MDR Side Configuration)
Sign in to the AWS Management Console with Account B
Open the IAM console.
From the navigation pane, choose Roles.
Choose to Create role.
For Select the type of trusted entity, choose AWS service.
For Choose the service that will use this role, choose EC2
Choose Next: Permissions.
Choose Next: Tags.
You can add optional tags to the role. Or, you can leave the fields blank, and then choose Next: Review.
For the Role name, enter a name for the role.
Choose to Create role.
From the list of roles, choose the role that you just created.
Choose to Add inline policy, and then choose the JSON view.
...
23. Go to the LCP UI and configure the appropriate collector using the below sensor configuration
...