Accenture MDR Quick Start Guide for AWS VPN

This quick start guide will help Accenture MDR customers configure Amazon Web Services (AWS) VPN to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring AWS VPN

MxDR supports log collection using CloudWatch.

Prerequisite:

• Cloudwatch log group is created. Please refer the following page to create a Cloudwatch loggroup. https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html

• Client VPN endpoint is created and configured except the logging part.

Device Configuration Steps :

Enable connection logging:

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/

2. In the navigation pane, choose Client VPN Endpoints.

3. Select the Client VPN endpoint, choose Actions, and then choose Modify Client VPN endpoint.

4. Under Connection logging, turn on Enable log details on client connections.

5. For CloudWatch Logs log group name, choose the name of the CloudWatch Logs log group.

6. For CloudWatch Logs log stream name, choose the name of the CloudWatch Logs log stream (Optional).

7. Choose Modify Client VPN endpoint.

Open

Note:Please refer below page to check required IAM user policies.

https://mdrkb.atlassian.net/wiki/x/hoCdEQ

Note: Below are the URL details which we need to allow for connectivity (Please identify URLs by referring AWS document according to your services and regions):

IAM: For any logging source IAM URL should be allowed

https://docs.aws.amazon.com/general/latest/gr/iam-service.html

Cloudwatch: For cloudwatch logging source, cloudwatch URL should be allowed.

https://docs.aws.amazon.com/general/latest/gr/cwl_region.html

LCP Configuration Parameters 

MxDR supports log collection using role based access control (RBAC) or access key ID and secret method.

• To create access key ID and secret please refer https://docs.aws.amazon.com/powershell/latest/userguide/pstools-appendix-sign-up.html

• To support log collection using RBAC please refer Accenture MDR Quick Start Guide for Role Based Access Control in AWS Generic Sensor

Table 1-2: The AWS VPN event collector (API - 5032) properties to be configured by MDR are shown in the table.