AWS Key Management Service (KMS)

AWS Key Management Service (KMS) lets users create and manage keys and control encryption across AWS services and in their applications. AWS KMS is a secure and resilient service that uses FIPS 140-3 Security Level 3 validated hardware security modules to protect its keys. AWS KMS is integrated with AWS CloudTrail to provide users with logs of all key usage, helping meet their regulatory and compliance needs.

AWS configuration

AWS CloudTrail records AWS KMS management events, such as CreateKey, CreateAlias, DisableKey, and ScheduleKeyDeletion, as API calls. Wazuh reads these events from the S3 bucket where CloudTrail stores its logs, so a CloudTrail trail is all you need. If you already collect AWS CloudTrail logs with Wazuh, the KMS events are already included. The following diagram shows how AWS KMS events reach the Wazuh agent through AWS CloudTrail and an S3 bucket.

AWS KMS events reaching Wazuh through AWS CloudTrail and an S3 bucket

CloudTrail trail for AWS KMS events

If you don't have a CloudTrail trail that logs management events yet, create one. If you already have one, check that it doesn't exclude AWS KMS events and skip to the policy configuration.

Follow these steps to create a CloudTrail trail.

On your AWS console, search for cloudtrail in the search bar or go to Services > Management & Governance > CloudTrail.
Click Trails, then click Create trail.
Assign a Trail name. Log file SSE-KMS encryption is enabled by default for new trails. If you keep it, keep the KMSDecrypt statement in the policies of the next section so that Wazuh can decrypt the logs.
Under Storage location, select Use existing S3 bucket and enter your bucket name. If Log file SSE-KMS encryption is enabled, assign a name for a new AWS KMS alias or choose an existing one. Click Next.
Under Event type, make sure Management events is selected. Set API activity to Read and Write, and make sure Exclude AWS KMS events isn't selected. Click Next.
Review the configuration and click Create trail.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, the user must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        },
        {
            "Sid": "KMSDecrypt",
            "Effect": "Allow",
            "Action": "kms:Decrypt",
            "Resource": "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>"
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        },
        {
            "Sid": "KMSDecrypt",
            "Effect": "Allow",
            "Action": "kms:Decrypt",
            "Resource": "arn:aws:kms:<REGION>:<ACCOUNT_ID>:key/<KEY_ID>"
        }
    ]
}

Note

<WAZUH_AWS_BUCKET> is a placeholder. Replace it with the actual name of the bucket from which you want to retrieve logs. If your trail encrypts its log files with SSE-KMS, replace <REGION>, <ACCOUNT_ID>, and <KEY_ID> in the KMSDecrypt statement with the Region, account ID, and ID of that KMS key. Otherwise, remove the KMSDecrypt statement.

Wazuh deletes the log files from the bucket only if you set remove_from_bucket to yes in the bucket configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group the user belongs to. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on using other methods is available in the AWS documentation.

Configure Wazuh to process AWS KMS logs

Make sure that the AWS integrations are enabled on the Wazuh dashboard, as described in Enable AWS integration on the Wazuh dashboard.
Add the following Wazuh module for AWS configuration to the /var/ossec/etc/ossec.conf file on the Wazuh agent. Replace <WAZUH_AWS_BUCKET> with the name of the S3 bucket that stores your CloudTrail logs. If this agent already reads that bucket with a <bucket type="cloudtrail"> block, you don't need another one. If the file already has a <wodle name="aws-s3"> block, add only the <bucket> section to it:
```
<wodle name="aws-s3">
  <disabled>no</disabled>
  <interval>10m</interval>
  <run_on_start>yes</run_on_start>
  <skip_on_error>yes</skip_on_error>
  <bucket type="cloudtrail">
    <name><WAZUH_AWS_BUCKET></name>
    <aws_profile>default</aws_profile>
  </bucket>
</wodle>
```
Note

This example uses the aws_profile authentication parameter. Check the Configure AWS credentials section to learn more about the different authentication options and how to use them.
Save the changes and restart the Wazuh agent service to apply the changes.
```
# systemctl restart wazuh-agent
```

KMS use case

AWS Key Management Service allows you to create and control cryptographic keys for securing your data. Monitoring this service with Wazuh helps you understand the availability and state of your AWS KMS keys.

Below is a use case for Wazuh findings built for AWS KMS.

Monitoring KMS key management events

When KMS management events occur, the Wazuh dashboard shows these findings:

AWS KMS key created (CreateKey)
AWS KMS alias created (CreateAlias)
AWS KMS key disabled or deletion cancelled (DisableKey, CancelKeyDeletion)
AWS KMS key deletion scheduled (ScheduleKeyDeletion)

You can expand the finding to see more information, such as the key policy, encryption type, and other details about the affected key.

Details of an AWS KMS key management finding