The AWS sensor

Enable and configure the necessary AWS services - AWS Config, AWS CloudTrail, Amazon SQS and Amazon SNS must be enabled and configured.

Configure your AWS user account permissions.

(Optional) Configure a Lifecycle rule on the S3 bucket.

Configure a multi-region CloudTrail trail.

1. Log into your AWS console.

2. Use the search bar to look up "CloudTrail".

3. In the CloudTrail page, click the Create a trail button.

4. Give the trail a name.

5. In the Storage location section, select Create new S3 bucket.

6. In the Trail log bucket and folder field enter a unique bucket name.

7. In the Log file SSE-KMS encryption section, clear the Enabled checkbox.

8. Leave the rest of the fields with their default settings and click Next.

   

9. In the Events section, select all three categories : Management events, Data events, and Insights events.

10. In the Management events section, under API activity, select the Read and Write checkboxes.

11. In the Data events section, expand the Data event: S3 section.

12. For the Data event type field, select S3 from the drop-down menu.

13. For the Log selector template field, select Log all events from the drop-down menu.

14. In the Insights events section, select both checkboxes: API call rate and API error rate.

15. Click Next.

16. In the Review and create page, click Create trail.

    You will be redirected to the Trails grid.

Configure S3 permissions for the AWS Config service.

1. In the Trails grid, click the S3 bucket.

   

2. In the Objects page, click the bucket name listed in the breadcrumb menu.

   

3. In the bucket page, click the Permissions tab.

4. Scroll down to the Bucket policy section and click the Edit button.

5. Copy the following code block:

     {
         "Sid": "AWSConfigBucketPermissionsCheck",
         "Effect": "Allow",
         "Principal": {
             "Service": "config.amazonaws.com"
         },
         "Action": "s3:GetBucketAcl",
         "Resource": "BUCKET_ARN",
         "Condition": {
             "StringEquals": {
                 "AWS:SourceAccount": "ACCOUNT_ID"
             }
         }
     },
     {
         "Sid": "AWSConfigBucketExistenceCheck",
         "Effect": "Allow",
         "Principal": {
             "Service": "config.amazonaws.com"
         },
         "Action": "s3:ListBucket",
         "Resource": "BUCKET_ARN",
         "Condition": {
             "StringEquals": {
                 "AWS:SourceAccount": "ACCOUNT_ID"
             }
         }
     },
     {
         "Sid": "AWSConfigBucketDelivery",
         "Effect": "Allow",
         "Principal": {
             "Service": "config.amazonaws.com"
         },
         "Action": "s3:PutObject",
         "Resource": "BUCKET_ARN/AWSLogs/ACCOUNT_ID/Config/*",
         "Condition": {
             "StringEquals": {
                 "AWS:SourceAccount": "ACCOUNT_ID",
                 "s3:x-amz-acl": "bucket-owner-full-control"
             }
         }
     }

6. In the Policy section, add a comma after the last statement and paste the code block on a new line, before the closed square bracket.

7. Update the two placeholders in the code: BUCKET_ARN and ACCOUNT_ID. The value for Bucket ARN is displayed above the Policy section. Save these values for later use.

8. To find your Account ID, click your username in the upper-right corner of the page. Your Account ID is displayed in the drop-down menu, right below your username.

9. Click Save changes.

Configure AWS Config and enable AWS Config recording

1. Use the search bar in the AWS console to look up "Config".

2. In the left-side menu, click Set up AWS Config. Do not use the 1-click setup option.

   Note

   This step assumes the AWS Config service was never configured in your current AWS account region. If the AWS Config service is already configured, access the Settings page in the left-side menu. Click Edit, select the Enable recording checkbox and confirm your choice. Next, follow the same steps described below.

3. In the General Settings section, under Recording strategy, select Record all current and future resource types supported in this region.

4. Select the Include globally recorded resource types checkbox.

5. For the AWS Config role field, select the Use an existing AWS Config service-linked role option.

   You can leave the rest of the fields with their default values.

6. In the Delivery method section, under Amazon S3 bucket, select the Choose a bucket from your account option.

7. For the S3 Bucket name (required) field, select the S3 bucket previously created at step 1.

8. In the Amazon SNS topic section, select the Stream configuration changes and notifications to an Amazon SNS topic checkbox.

9. Select the Create a topic option.

10. Enter a name for the SNS topic.

11. Click Next twice, and then confirm your choice.

Configure the SQS queue and subscribe it to the SNS topic.

1. Use the search bar in the AWS console to look up "Amazon SQS".

2. In the Amazon SQS page, open the left-side menu and click Queues.

3. In the Queues grid, click Create queue.

4. In the Details section, for the Type field, select Standard.

5. Enter a name for the queue.

6. Leave the rest of the fields with their default values and click Create queue.

   You will be redirected to the queue's dedicated page.

7. Copy the queue URL and ARN values for later use.

   

8. In the SNS subscriptions tab, click Subscribe to Amazon SNS topic.

9. In the drop-down menu, select the SNS topic you created at step 3, and click Save.

   You will be redirected to the queue's dedicated page.

10. Click the Access policy tab.

11. In the Access policy (Permissions) section, click Edit.

12. Copy the following code block:

    {
      "Sid": "Stmt1678745203026",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "QUEUE_ARN",
      "Condition": {
        "StringLike": {
          "aws:SourceArn": "BUCKET_ARN"
        },
        "StringEquals": {
           "aws:SourceAccount": "ACCOUNT_ID"
      }
      }
    }

13. Scroll down to the Access policy section, add a comma after the last statement of the policy, and paste the code block on a new line, before the last closed square bracket.

14. Update the three placeholders in the code: BUCKET_ARN, ACCOUNT_ID, and QUEUE_ARN with the values from steps 2g., 2h., and 4g.

15. Click Save.

Configure S3 bucket events.

1. Use the search bar in the AWS console to look up "S3" and select the S3 option.

2. In the left-side menu, click Buckets.

3. In the Buckets page, click the S3 bucket you created.

4. Click the Properties tab.

5. Scroll down to the Event Notifications section and click the Create event notification button.

6. In the General configuration section, provide a name for the notification configuration.

7. In the Event types section, under Object creation, select the All object create events checkbox.

8. In the Destination section, under Destination, select the SQS queue option.

9. Under Specify SQS queue, select the Choose from your SQS queues option, and select the SQS queue you created at step 4.

10. Click Save changes.

Create the policies that contain the desired permissions:

Apply these policies to an IAM service account.

Grant the IAM service account access to the S3 bucket you previously created.

Configure limited public access to the S3 bucket via access point policies.

Grant the IAM service account access to the SQS queue you previously created.

Use the search bar in the AWS console to look up "S3" and select the S3 option.

In the left-side menu, click Buckets.

In the Buckets page, click the S3 bucket you created at step 1 in Configure the necessary AWS services.

In the bucket details page, click the Management tab.

In the Lifecycle rules section, click the Create lifecycle rule button.

In the Create lifecycle rule page, provide a name for the rule.

For the rule scope, select the Apply to all objects in the bucket option.

Select the I acknowledge that this rule will apply to all objects in the bucket checkbox.

In the Lifecycle rule actions section, select the following checkboxes:

In the Expire current versions of objects section, in the Days after object creation field, enter 30.

In the Delete expired object delete markers or incomplete multipart uploads section, in the Number of days field, enter 30.

Click Create rule.