Amazon CLB

Classic Load Balancers (Amazon CLB) are one of the load balancer types that Elastic Load Balancing offers. A Classic Load Balancer distributes incoming traffic across its registered EC2 instances in one or more Availability Zones, and routes traffic only to the healthy instances. It makes routing decisions at either the transport layer (TCP/SSL) or the application layer (HTTP/HTTPS).

AWS configuration

The following sections cover how to configure the Amazon CLB service to integrate with Wazuh.

Amazon CLB configuration

Go to S3 buckets, copy the name of an existing S3 bucket or create a new one. The bucket needs a bucket policy that allows Elastic Load Balancing to write the access logs. The AWS documentation in the note below gives the policy to use.
On your AWS console, search for ec2 in the search bar or go to Services > Compute > EC2.
Go to Load Balancing > Load Balancers on the left menu. Create a new load balancer or select one or more load balancers and select Edit load balancer attributes on the Actions menu.
In the Monitoring tab, enable Access logs, and then define the S3 bucket and the path where the logs are stored. The Wazuh configuration below uses CLB as the path. If you enter a different path, set the <path> value to match it.

Note

To enable access logs and add the bucket policy that Elastic Load Balancing needs, see Enable access logs for your Classic Load Balancer.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

Note

<WAZUH_AWS_BUCKET> is a placeholder. Replace it with the actual name of the bucket from which you want to retrieve logs.

Wazuh deletes the log files from the bucket only if you set remove_from_bucket to yes in the bucket configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group to which the user belongs. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on how to use other methods is available in the AWS documentation.

Configure Wazuh to process Amazon CLB logs

Make sure that the AWS integrations are enabled on the Wazuh dashboard, as described in Enable AWS integration on the Wazuh dashboard.
Add the following Wazuh module for AWS configuration to the /var/ossec/etc/ossec.conf file on the Wazuh agent. Replace <WAZUH_AWS_BUCKET> with the name of the S3 bucket that stores the CLB access logs. If the file already has a <wodle name="aws-s3"> block, add only the <bucket> section to it:
```
<wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>10m</interval>
  <run_on_start>yes</run_on_start>
  <skip_on_error>yes</skip_on_error>
  <bucket type="clb">
    <name><WAZUH_AWS_BUCKET></name>
    <path>CLB</path>
    <aws_profile>default</aws_profile>
  </bucket>
</wodle>
```
Note

This example uses the aws_profile authentication parameter. Check the Configure AWS credentials section to learn more about the different authentication options and how to use them.
Save the changes and restart the Wazuh agent service to apply the changes:
```
# systemctl restart wazuh-agent
```

CLB use case

Monitoring backend errors

A request through the Classic Load Balancer can fail, for example, with HTTP 503 when no registered instance is healthy. The Wazuh dashboard then shows the AWS Classic Load Balancer backend error finding. To see these findings, go to Amazon Web Services > Findings.

Expand a finding to see its details:

HTTP status code (http.response.status_code)
Request method and path (http.request.method and url.path)
Full request URL (url.original)
Client address and port (source.address and source.port)
Load balancer name (observer.name)
User agent (user_agent.original)