Accenture MDR Quick Start Guide for Amazon Web Service (AWS) Elastic Load Balancer

This quick start guide will help Accenture MDR customers configure Amazon Web Service (AWS) Elastic Load balancer to allow log collection from the Log Collection Platform (LCP). 

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring AWS Elastic Load Balancer

• MxDR supports log collection using S3 via SQS.

Prerequisite:

• S3 bucket is created. Please refer the following page to create a S3 bucket.  https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

• To create Elastic Load Balancer please refer https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/load-balancer-getting-started.html

Device Configuration Steps:

To enable access logging to send Access Logs to S3

• Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

• In the navigation pane, choose Load Balancers.

• Select your load balancer.

• On the Description tab, choose Edit attributes.

• On the Edit load balancer attributes page, do the following:

  • Choose Enable access logs.

  • For S3 location, type the name of your S3 bucket, including any prefix (for example, my-loadbalancer-logs/my-app). Please be sure that you own this bucket and that you configured the required bucket policy.

  • Choose Save.

Open

Creating Amazon Simple Queue Service (SQS) and attaching it to S3:

To create SQS and attach it with S3 please refer https://mdrkb.atlassian.net/wiki/x/AQCeEQ

For more information please refer : https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#enable-access-logging

Note: Please refer below page to check required IAM user and KMS Key policies for S3, SQS and KMS

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

S3: For S3 or SQS logging source, S3 URL should be allowed.

SQS: For SQS logging source, SQS URL should be allowed.

LCP Configuration parameters

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer

• To support log collection using RBAC please refer

Table 1-2: The AWS Elastic Load balancer event collector (3965 -API) properties to be configured by MDR in table.