Custom Logs Buckets

Amazon Simple Queue Service

Create a Standard type SQS queue in the Amazon SQS console with the default configurations. You can apply an access policy like the following example. Replace <REGION>, <ACCOUNT_ID>, <SQS_NAME>, and <S3_BUCKET> with your region, account ID, SQS queue name, and the name you give the S3 bucket.

{
"Version": "2012-10-17",
"Id": "example-ID",
"Statement": [
  {
    "Sid": "example-access-policy",
    "Effect": "Allow",
    "Principal": {
      "Service": "s3.amazonaws.com"
    },
    "Action": "SQS:SendMessage",
    "Resource": "arn:aws:sqs:<REGION>:<ACCOUNT_ID>:<SQS_NAME>",
    "Condition": {
      "StringEquals": {
        "aws:SourceAccount": "<ACCOUNT_ID>"
      },
      "ArnLike": {
        "aws:SourceArn": "arn:aws:s3:*:*:<S3_BUCKET>"
      }
    }
  }
]
}

You can configure your access policy to accept S3 notifications from different account IDs and to apply different conditions. For more information, see managing access in Amazon SQS.

Amazon S3 and Event Notifications

To configure an S3 bucket that reports creation events, do the following.

1. Configure an S3 bucket as defined in the configuring an S3 bucket section. Provide the name you decided in the previous section.

2. After you create the bucket, go to Event notifications inside the Properties tab, then click Create event notification.

3. In Event Types, select All object create events. The bucket then sends a notification for every event that creates an object in it.

4. In the Destination section, select SQS queue, then select Choose from your SQS queues.

5. Choose the queue you created previously.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console. Attach a policy like the following to the AWS identity that the Wazuh module for AWS uses. Replace <REGION>, <ACCOUNT_ID>, <SQS_NAME>, and <S3_BUCKET> with your values.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ReadNotificationQueue",
            "Effect": "Allow",
            "Action": [
                "sqs:GetQueueUrl",
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage"
            ],
            "Resource": "arn:aws:sqs:<REGION>:<ACCOUNT_ID>:<SQS_NAME>"
        },
        {
            "Sid": "ReadLogBucket",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<S3_BUCKET>",
                "arn:aws:s3:::<S3_BUCKET>/*"
            ]
        }
    ]
}

Queue

• <sqs_name>: The name of the queue.

• Optional – <service_endpoint>: The AWS S3 endpoint URL for data downloading from the bucket. Check Using VPC and FIPS endpoints for more information about VPC and FIPS endpoints.

Authentication

The available authentication methods are the following:

• IAM roles

• Profiles

These authentication methods require using the /root/.aws/credentials file to provide credentials. You can find more information in the Configure AWS credentials section.

The available authentication configuration parameters are the following:

• <aws_profile>: A valid profile name from a shared credentials file or AWS config file with permission to read logs from the bucket.

• <iam_role_arn>: Amazon Resource Name (ARN) for the corresponding IAM role to assume.

• Optional – <iam_role_duration>: The session duration in seconds.

• Optional – <sts_endpoint>: The URL of the VPC endpoint of the AWS Security Token Service.