AWS Config

About the Device

AWS Config offers a comprehensive perspective on the configuration of AWS resources within your AWS account. This encompasses the interconnections between resources and their historical configurations, enabling you to track changes in configurations and relationships over time.

Device Information

Entity	Particulars
Vendor Name	Amazon Web Services
Product Name	Config
Type of Device	Cloud

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method	Data Source
AWS Config	AWS_CONFIG	API Pull	C2C - Storage	https://cloud.google.com/chronicle/docs/reference/feed-management-api#amazon_s3

Device Configuration

Adaptive MxDR supports log collection using S3 and SQS.

Prerequisite:

AWS Config is enabled. Please refer below page to enable AWS Config: https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html
S3 bucket is created. Please refer the following page to create a S3 bucket. https://docs.aws.amazon.com/AmazonS3/latest/userguide/creating-bucket.html

Configuring S3

Follow the below steps to configure Config to send logs to S3:

Sign in to the AWS Management Console and open the AWS Config console.
Navigate to the Settings

On the Settings page, for Resource types to record, specify all the resource types you want AWS Config to record.
For AWS Config role, choose either an existing AWS Config service-linked role or choose a role from your account by entering your Account ID.
For Delivery method, choose the Amazon S3 bucket to which AWS Config sends configuration history and configuration snapshot files.

Click Save

Granting AWS Config access to the Amazon S3 Bucket:

Follow the below steps to add an access policy to the Amazon S3 bucket in your own account or another account. The access policy allows AWS Config to send configuration information to the Amazon S3 bucket.

Open the Amazon S3 console
Select the bucket that you want AWS Config to use to deliver configuration items, and then choose Properties.
Choose Permissions
Choose Edit Bucket Policy
Copy the following policy into the Bucket Policy Editor window and please replace placeholders<.> with the actual values

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSConfigBucketPermissionsCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::<targetBucketName>",
      "Condition": { 
        "StringEquals": {
          "AWS:SourceAccount": "<sourceAccountID>"
        }
      }
    },
    {
      "Sid": "AWSConfigBucketExistenceCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::<targetBucketName>",
      "Condition": { 
        "StringEquals": {
          "AWS:SourceAccount": "<sourceAccountID>"
        }
      }
    },
    {
      "Sid": "AWSConfigBucketDelivery",
      "Effect": "Allow",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::<targetBucketName/[optional] prefix>/AWSLogs/<sourceAccountID>/Config/*",
      "Condition": { 
        "StringEquals": { 
          "s3:x-amz-acl": "bucket-owner-full-control",
          "AWS:SourceAccount": "<sourceAccountID>"
        }
      }
    }
  ]
}

If you want to configure using SQS, please follow below steps:

Follow all the steps provided above to store logs in S3 bucket
Create SQS and attach it with S3. Please refer Configuring AWS Simple Queue Service (SQS) with S3 Storage

Please refer below page to check required IAM user policies.

IAM User and KMS Key Policies Required for AWS

For more details on how to get required credentials for integration parameters please refer:

Get Credentials for AWS Storage

Integration Parameters

S3

Property	Default Value	Description
REGION	N/A	Select the region of your S3 bucket
S3 URI	N/A	The S3 URI to ingest. (It will be a combination of S3 bucket name and prefix. Example: S3://<S3 bucket name>/<prefix>)
URI IS A	N/A	The type of file indicated by the URI. Valid values are: `FILES`: The URI points to a single file which will be ingested with each execution of the feed. `FOLDERS`: The URI points to a directory. All files contained within the directory will be ingested with each execution of the feed. `FOLDERS_RECURSIVE`: The URI points to a directory. All files and directories contained within the indicated directory will be ingested, including all files and directories within those directories, and so on.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.
ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.

SQS

Property	Default value	Description
REGION	N/A	Select the region of your S3 bucket
QUEUE NAME	N/A	The SQS queue name.
ACCOUNT NUMBER	N/A	The account number for the SQS queue and S3 bucket.
QUEUE ACCESS KEY ID	N/A	This is the 20 character ID associated with your Amazon IAM account.
QUEUE SECRET ACCESS KEY	N/A	This is the 40 character access key associated with your Amazon IAM account.
SOURCE DELETION OPTION	N/A	Whether to delete source files after they have been transferred to Chronicle. This reduces storage costs. Valid values are: `SOURCE_DELETION_NEVER`: Never delete files from the source. `SOURCE_DELETION_ON_SUCCESS`:Delete files and empty directories from the source after successful ingestion. `SOURCE_DELETION_ON_SUCCESS_FILES_ONLY`:Delete files from the source after successful ingestion.