VPC Flow Log via CloudTrail Configuration on AWS Cloud

This document describes the steps required to configure VPC Flow logs via CloudTrail on AWS cloud. We recommend that these steps are performed on a call with the guidance of ARIA Technical Support. 

1. CloudTrail Configuration:
   1. Login to your AWS Dashboard for your region.
      
       
   2. In the search bar, type ‘cloud trail’ and navigate to the service.
      
       
   3. You may use an existing trail or create a new one. In our case, we are going to create a new one with the ‘Create trail’ button.
      
       
   4. Trail Attributes:
      1. Trail Name: Choose a descriptive name
      2. Storage Location: Create a new s3 bucket or use an existing one.  
      3. Trail log bucket and folder: Choose a descriptive name (e.g. aria-aws-cloudtrail-logs) 
      4. Log file SSE-KMS encryption: disabled 
      5. CloudWatch Logs: disabled 
      6. Event type:  
         1. management events 
         2. API Activity: read + write 
   5. Confirm your settings and then select ‘Create trail’
2. IAM Role + Policy Configuration 
   1. In the search bar, type ‘IAM’ and navigate to the service.
      
       
   2. In the navigation pane, select ‘Policies’ 
   3. Choose ‘Create Policy’ 
   4. On the ‘Create Policy’ page, do the following: 
      1. Choose JSON 
      2. Replace the contents of this window with the following permissions policy:
         
          
      3. Choose ‘Next’. 
      4. Give the policy a descriptive name and an optional description and select create.
   5. In the navigation pane, choose ‘Roles’ and then ‘Create role’. 
   6. Choose ‘Custom trust policy’ and replace “Principle”:{}, with the entry below and then choose ‘Next’.
      
       
   7. Search for the policy created earlier, mark the checkbox next to it and select ‘Next’.
      
       
   8. Enter a name and description for the role and then select ‘Create role’. 
3. IAM Access Key Configuration
   Note: Before you begin, create a new user and assign the policy if none exist with the IAM user set to 'AmazonS3ReadOnlyAccess'.
   1. Sign into the AWS console as the IAM user to be used for VPC Flow log collection. 
   2. Select the account drop-down in the top right, then choose ‘Security credentials’
      
       
   3. Scroll down to ‘Access Keys’. 
   4. If you already have an access key, please note down the key id and the secret value for later. Otherwise, select ‘Create access key’. 
   5. Select ‘Third-party service’ as a use case then confirm and select ‘Next’. 
   6. Add a description tag and then create the access key. Be sure to store the key id and secret value in a safe place. We will need these later. 
4. AWS VPC Flow Log Configuration 
   1. Use the top search bar to navigate to the ‘VPC’ service.  
   2. In the navigation pane, select ‘Your VPCs’
      
       
   3. Right-click the desired VPC and select ‘Create flow log’.
      
       
   4. Flow log settings: 
      1. Name: choose a descriptive name 
      2. Filter: All 
      3. Maximum aggregation interval: 10 minutes 
      4. Destination: Send to CloudWatch Logs 
      5. Destination log group: choose the CloudWatch log group created previously or an existing group. Please keep note of the log group for future configuration.  
      6. IAM role: choose the role created previously. 
      7. Log format: Custom (Select the ones below IN ORDER).
         
          
      8. Select ‘Create flow log’.
5. ARIA ADR VPC Flow Log Ingestion Configuration 
   1. Login to your Aria tenant with the credentials provided. 
   2. In the navigation pane, choose ‘Settings > Provisioning > Cloud Devices > AWS Configuration’
      
       
   3. Choose ‘Configure Flow services’, then select ‘Add’.
   4. Fill in the following boxes with the information recorded from AWS. An example will look as follows.
      
       
   5. Review your setting and select ‘Save’.