Accenture MDR Quick Start Guide for Amazon Web Services (AWS) Web Application Firewall (WAF)

This quick start guide will help Accenture MDR customers configure AWS WAF to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication. 

Configuring AWS WAF

Follow the below steps to configure the AWS WAF.

 Enable Logging for WEB ACL to S3 Bucket.

1. Log in to the AWS Console.

2. Navigate to AWS WAF and select Web ACL from right side pane.

3. Select the Web ACL's from the list and click Enable Logging button.

 Note : Admin access required for perform the Logging changes

4. If Kinesis Firehose stream is already created then select the Amazon Kinesis Firehose stream which is configured as the desired S3 Bucket for log storage. 

5. If it is not created, follow steps from create Kinesis Firehose stream.

6. In order to send the logs to S3 Bucket we need to create an Amazon Kinesis Data Firehose. 

Creating Amazon Kinesis Firehose

1. Navigate to Kinesis Dashboard and click on Create Delivery stream.

2. Provide the New delivery stream name

3. Select Direct PUT or other Sources from Source.

4. Click Next.

5. Keep Record Transformation and Record format conversion as Disabled and click Next.

6. Select Destination as Amazon S3.

7. Select the S3 Destination bucket name from drop-down.

Note: Leave the S3 Prefix and Error Prefix configuration textbox as unchanged.

  8. Use the default preset for Buffer Condition Settings.

9. Set S3 Compression and S3 Encryption as Disabled

10. Select Enabled for Error logging.

1. Add the IAM role inorder to enable the Firehose to Stream logs to S3.

   1. Click Create new or choose.​

b. Select Create a new IAM Role from IAM role drop-down menu.

c. Add the Role Name as firehose_delivery_role.

d. Keep the Policy name to Create a new Role policy and click Allow.

Note: It will automatically create a Policy and enable it. The policy name will be appear similar asoneClick_firehose_delivery_role_12312342123

 e. Click Next and review the configurations on the Review page.

f. Click Create Delivery Stream to create the Kinesis Firehose Delivery Stream.​

Enable loging for WEBACL to AWS WAF.

1. Select the created Firehose Data Stream from Amazon Kinesis Data Firehose drop-down menu .

2. Click Create 

​

3. Logging has enabled once it is created.

Configuring Amazon S3 to send the event notifications to SQS

Refer the document https://docs.aws.amazon.com/AmazonS3/latest/dev/NotificationHowTo.html to configure S3 to send event notification to SQS.

Note: Prerequisite: Following is the IAM user policies required for CloudWatch, SQS and S3:

IAM User Permission - SQS

{“Action”: [“sqs:GetQueueAttributes”,“sqs:GetQueueUrl”,“sqs:ReceiveMessage”,“sqs:DeleteMessage”,“sqs:ListQueues"],“Effect”: “Allow”,“Resource”: “arn:aws:sqs:region:accountID:SQSName”}

IAM User Permission - CloudWatch

{"Effect": "Allow","Action": ["logs:describeLogGroups","logs:describeLogStreams","logs:filterLogEvents","logs:getLogEvents"],"Resource": ["arn:aws:logs:region:accountID:log-group:specificLogGroupName"]}

IAM User Permission – S3

{"Effect": "Allow","Action": ["s3:ListBucket","s3:GetObject"],"Resource": ["arn:aws:s3:::bucketname", "arn:aws:s3:::bucketname/*"],"Condition": {}}

LCP Configuration Parameters

Table 1-2: The AWS WAF event collector (API - 3896) properties to be configured by MDR are given in the table.