Accenture MDR Quick Start Guide for Amazon Web Services (AWS) VPC Flow

This quick start guide will help Accenture MDR customers configure Amazon Web Services (AWS) VPC Flow to allow log collection from the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements         

Table 1-1: Port requirements for LCP communication.

Configuring AWS VPC Flow

MxDR supports log collection using Cloudwatch and S3 via SQS.

Prerequisite:

If you are using S3 via SQS log collection method, S3 bucket should be created. Please refer the following page to create a S3 bucket.  https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

If you are using Cloudwatch log collection method, Cloudwatch log group should be created. Please refer the following page to create a Cloudwatch log group. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html

Device Configuration Steps:

Configure flow logs to Amazon S3 if you are forwarding logs to S3

After you have created and configured your Amazon S3 bucket, you can create flow logs for your network interfaces, subnets, and VPCs.

Step I : To create a flow log for a network interface : 

1. Open the Amazon EC2 console

2. In the navigation pane, choose Network Interfaces

3. Select the checkboxes for one or more network interfaces

4. Choose Actions, Create flow log

5. Configure the flow log settings [Step 4]

Step II : To create a flow log for a subnet : 

1. Open the Amazon VPC console

2. In the navigation pane, choose Subnets.

3. Select the checkboxes for one or more subnets.

4. Choose Actions, Create flow log.

5. Configure the flow log settings [Step 4]

Step III : To create a flow log for a VPC: 

1. Open the Amazon VPC console

2. In the navigation pane, choose Your VPCs.

3. Select the checkboxes for one or more VPCs.

4. Choose Actions, Create flow log.

5. Configure the flow log settings [Step 4]

Step IV : To configure flow log settings : 

For Filter, specify the type of IP traffic to log. All type of traffic is supported.

• Accepted – Log only accepted traffic.

• Rejected – Log only rejected traffic.

• All – Log accepted and rejected traffic.

Open

For Maximum aggregation interval , choose 1 minute to take advantage of MSS's true IP functionality.

Open

For Destination, choose Send to an S3 bucket

ForS3 bucket ARN, specify the ARN of Amazon S3 bucket [covered in prerequisites]

For Log record format, specify the format for the flow log record : 

• To use the default flow log record format, choose AWS default format.

• To create a custom format, choose Custom format. For Log format, choose the fields to include in the flow log record.

NOTE : Please configure VPC log flow with Custom AWS log Format to take advantage of MSS true IP functionality  It will show a whole list of attributes in a drop-down pattern under Log Format. Select all the attributes in the defined order as mentioned in the below image. The sequence should be as it is mentioned below. The custom format can then be reviewed under Format Preview.

Important Note: Field customization must be in the sequential order as mentioned above.

For Log file format, choose the default format for the log file - Text.

For Hive-compatible S3 prefixes [optional Config] , Keep it unchecked

To partition your flow logs per hour, choose Every 1 hour (60 mins).

To add a tag to the flow log [optional config] , choose Add new tag and specify the tag key and value.

Choose Create flow log

For More details , Refer : https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html  

Configure flow logs to Amazon CloudWatch if you are forwarding logs to Cloudwatch

You can create flow logs for your VPCs, subnets, or network interfaces.

Repeat Step 1 to Step 3 from above to configure flow log either from VPC , subnets or Network Interfaces.

To configure flow log settings :

For Filter, specify the type of traffic to log. All type of filter is supported.

For Maximum aggregation interval , choose 1 minute to take advantage of MSS's true IP functionality.

For Destination, choose Send to CloudWatch Logs

For Destination log group, choose the name of the destination log group that you created [covered in pre requisites]

For IAM role, specify the name of the role that has permissions to publish logs to CloudWatch Logs.

For Log record format, select the Custom format for the flow log record. Available fields and order has been mentioned in above scenario.

To add a tag to the flow log [optional config] , choose Add new tag and specify the tag key and value.

Choose Create flow log

For More details , Refer :   

Configuring Amazon S3 to send the event notifications to SQS

https://mdrkb.atlassian.net/wiki/x/AQCeEQ

Note: Please refer below page to check required IAM user policies.

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

S3: For S3 or SQS logging source, S3 URL should be allowed.

SQS: For SQS logging source, SQS URL should be allowed.

Cloudwatch: For cloudwatch logging source, cloudwatch URL should be allowed.

LCP Configuration Parameters

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer

• To support log collection using RBAC please refer

Table 1-2: The AWS VPC Flow event collector (API - 3898) properties to be configured by MDR are shown in the table.