AWS Trusted Advisor

Amazon Kinesis configuration

Create an Amazon Kinesis Data Firehose delivery stream to be able to store the Trusted Advisor logs into the desired S3 bucket so Wazuh can process them.

1. Create a new S3 bucket. If you want to use an already existing one, skip this step.

2. Search for Kinesis in the search bar at the top of the page or go to Services > Analytics > Kinesis:

   

3. Select the Kinesis Data Firehose option and then click in the Create delivery stream button:

   

4. Select Direct PUT and Amazon S3 as the desired Source and Destination, respectively:

   

5. Choose an appropriate Delivery stream name:

   

6. Leave both Data transformation and Record format conversion options disabled:

   

7. Select the desired S3 bucket as the destination. It is possible to specify a custom prefix to alter the path where AWS store the logs. AWS Firehose creates a file structure YYYY/MM/DD/HH, if a prefix is used the created file structure would be prefix-name/YYYY/MM/DD/HH. If a prefix is used it must be specified under the Wazuh Bucket configuration:

   

8. Create or choose an existing IAM role to be used by Kinesis Data Firehose in the Advanced settings section:

   

9. Click on the Create delivery stream button at the end of the page. The new Delivery stream will be created and its details will be shown as follows:

   

Amazon EventBridge configuration

Configure an Amazon EventBridge rule to send Trusted Advisor events to the Amazon Kinesis Data Firehose delivery stream created in the previous step.

1. Search for EventBridge in the search bar at the top of the page or go to Services > Application Integration > EventBridge:

   

2. Click on the Create rule button:

   

3. Give an appropriate name for the EventBridge rule:

   

4. In the Define pattern section choose Event pattern, then Pre-defined pattern by service. Select AWS and Trusted Advisor as the Service provider and Service name, respectively. Choose All Events as the desired Event type:

   

5. Select the Firehose delivery stream created following the Kinesis steps as the Target for this EventBridge rule. Create a new role or specify an existing one for this resource if required:

   

6. Scroll down and click on Create rule. The new rule will now be present in the Amazon EventBridge > Rules section, ready to be used. From now on, every time a Trusted Advisor event is sent, it will be stored in the specified S3 bucket. Remember to enable the Trusted Advisor service first, otherwise no data will be processed:

   

AWS Trusted Advisor configuration

1. Search for Trusted Advisor in the search bar at the top of the page or go to Services > Management & Governance > Trusted Advisor:

   

2. Go to Preferences in the left menu and click on the Enable Trusted Advisor button:

   

Once enabled, Trusted Advisor reviews the different checks for the AWS account. Check the official AWS documentation to learn more about the different Trusted Advisor Checks available.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-name/*",
                "arn:aws:s3:::bucket-name"
            ]
        }
    ]
}

{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Sid": "VisualEditor0",
             "Effect": "Allow",
             "Action": [
                 "s3:GetObject",
                 "s3:ListBucket",
                 "s3:DeleteObject"
             ],
             "Resource": [
                 "arn:aws:s3:::bucket-name/*",
                 "arn:aws:s3:::bucket-name"
             ]
         }
     ]
 }