A number of log sources are available in AWS, that can be useful for incident
response purposes:
| Name | Conditions | Description |
|---|---|---|
CloudTrail |
Enabled by default. | Logs every operation conducted in the AWS account through Amazon Management Console actions and API calls. Essentially logs all management operations API calls made in the account. For each action / operation, the following information is logged: - Unique Event ID. - Event name (such as ListPolicies, AssumeRole, etc.). - The timestamp of the operation. - The region the operation was conducted in. - Information on who realized the action (IAM identity, source IP address, user agent). - The eventual impacted resource. - The eventual request parameters. - … |
CloudWatch |
Some AWS products automatically push metrics to Amazon CloudWatch (for free), while other services may require additional configuration to push metrics. | Logs system performance metrics such as CPU usage, filesystem or network inputs/outputs, etc. An additional CloudWatch agent can be installed on EC2 hosts to forward OS-level logs to CloudWatch. CloudTrail logs can be forwarded to CloudWatch, for instance to configure automated alerting. |
AWS Config |
AWS Config is not enabled by default. | Records the configuration state of a number of resources (EC2, VPC, security groups, etc.) in the AWS account. There are two frequencies at which AWS Config can deliver configuration items: periodic and continuous. Periodic recording delivers configuration data once every 24 hours, only if a change has occurred. Continuous recording delivers configuration items whenever a change occurs. If enabled, AWS Config can be used to detect change in configuration and retrieve historical data on configuration changes (who and when was a given resource created / modified). |
S3 Access Logs |
S3 Access Logs are not enabled by default and must be enabled on a per bucket basis. |
Logs bucket-level activities, i.e. access, upload, modification, and deletion of data stored in a S3 bucket (versus operation on the bucket object itself as logged by CloudTrail). |
CloudWatch |
VPC Flow Logs are not enabled by default and must be enabled either at the VPC, subnet, or Elastic Network Interfaces (ENI) level. |
Logs IP network traffic to CloudWatch or an S3 bucket. Different version of VPC Flow Logs, 2 to 5 to date, can be enabled. Higher versions record an increased number of fields per record. The version 2, chosen by default, records the following fields (in order): - version number. - account id (AWS account ID of the owner of the source network interface for which traffic is recorded). - interface id (ID of the network interface for which the traffic is recorded). - source address. - destination address. - source port. - destination port. - network protocol. - number of packets transferred during the “flow” log. - number of bytes transferred during the “flow” log. - start of the “flow” log. - end of the flow log. - whether the traffic was accepted ( ACCEPT) or rejected (REJECT). - status of the flow log. Data is aggregated over one or ten minutes intervals, depending on the flow log definition. For more information on VPC Flow Logs, refer to the official AWS documentation. |
WAF Logs |
WAF Logs require the use of the AWS WAF service. |
Logs requests processed by the AWS WAF service. WAF Logs can notably be forwarded to CloudWatch or stored in a S3 bucket. Information about the request (source IP, eventual requests headers, eventual parameters, etc.) as well as the rule matched are logged. |
References
View on GitHub