Amazon Security Lake

Logging in and navigating

1. Log in to your AWS console and navigate to Security Lake.

2. Navigate to Subscribers, and click Create subscriber.

Creating a subscriber

1. Enter a descriptive name for your subscriber, for example, Wazuh.

2. Select S3 as your data access method.

3. Under S3 notification type select SQS queue.

4. Enter the AWS account ID for the account you are currently logged into.

5. Enter a unique value in External ID, for example, WAZUH-EXTERNAL-ID-VALUE.

6. Choose to either collect all log and event sources, or only specific log and event sources.

7. Click Create.

Reviewing the subscriber

1. Navigate to My subscribers section, and click your newly created subscriber to get to the Subscriber details page.

2. Check that AWS created the subscriber with the correct parameters.

3. Save the SQS queue name, which is the last part of the Subscription endpoint value. You need it to configure the Wazuh module for AWS and to verify the information in the SQS queue.

Configuring the role

Follow these steps to modify the Security Lake subscriber role. You have to associate an existing IAM user with the role. Use the user whose access keys are in the AWS profile that you set in the Wazuh module for AWS configuration.

1. In your AWS console, navigate to the Amazon IAM service.

2. In your Amazon IAM service, navigate to the Roles page.

3. In the Roles page, select the subscriber role that Security Lake created when you created the subscriber.

4. In the Summary page, navigate to the Trust relationships tab to modify the Trusted entity policy.

5. Modify the Trusted entity policy with the following updates:

   • In the trust policy, set the AWS principal to the ARN of the IAM user that you associate with the role. The Wazuh module for AWS can then assume the role with the access keys of this user. See the following trust policy example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "1",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::<ACCOUNT_ID>:user/<USERNAME>"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                       "StringEquals": {
                           "sts:ExternalId": [
                               "<EXTERNAL_ID>"
                           ]
                       }
               }
           }
       ]
   }
   

   Note

   <ACCOUNT_ID>, <USERNAME> and <EXTERNAL_ID> are placeholders. Replace them with the appropriate values.

Granting user permission to switch roles

Follow these steps to configure the user permissions:

1. In your Amazon IAM service, navigate to the Users page.

2. In the Users page, select the Username of the user you have connected to the role (<USERNAME>).

3. On the Permissions tab, select Add permissions > Create inline policy.

   In the Policy editor, select JSON and paste the following policy. Replace <ACCOUNT_ID> with your AWS account ID and <RESOURCE_ROLE> with the subscriber role that Security Lake created. This policy lets the user switch to the subscriber role. After you paste the policy, click Next, enter a policy name, and click Create policy.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
           "Sid": "VisualEditor1",
           "Effect": "Allow",
           "Action": "sts:AssumeRole",
           "Resource": "arn:aws:iam::<ACCOUNT_ID>:role/<RESOURCE_ROLE>"
           }
       ]
   }