AWS Trusted Advisor

Amazon Data Firehose configuration

Create an Amazon Data Firehose delivery stream to store the Trusted Advisor logs into the desired S3 bucket so Wazuh can process them.

1. Create a new S3 bucket, or skip this step to use an existing bucket.

2. On your AWS console, search for amazon data firehose in the search bar or go to Services > Analytics > Amazon Data Firehose.

   

3. Click Create Firehose stream.

   

4. Select Direct PUT and Amazon S3 as the desired Source and Destination, respectively, and choose an appropriate Firehose stream name.

   

5. Select the desired S3 bucket as the destination. You can specify a custom prefix to change the path where AWS stores the logs. Amazon Data Firehose creates a file structure YYYY/MM/DD/HH. If you use a prefix, the file structure is prefix-name/YYYY/MM/DD/HH, and you must enter the same prefix as the path value in the Wazuh configuration. In this example, the prefix is trusted-advisor/.

   

6. Create or choose an existing IAM role to be used by Amazon Data Firehose in the Advanced settings section.

   

7. Click Create Firehose stream at the end of the page.

   

Amazon EventBridge configuration

Configure an Amazon EventBridge rule to send Trusted Advisor events to the Amazon Data Firehose delivery stream created in the previous step.

1. On your AWS console, search for eventbridge in the search bar or go to Services > Application Integration > Amazon EventBridge.

   

2. Select Event buses, under Default event bus, click default, then click Create rule.

   
   

3. Select Advanced builder, assign a name to the EventBridge rule, and click Next.

   

4. In the Build event pattern section, choose AWS events or EventBridge partner events as Event source.

   

5. In the Event pattern section, choose AWS services as Event source, Trusted Advisor as AWS service, and All Events as Event type. Click Next.

   

6. Under Select a target, choose Firehose stream and select the stream created previously. Also, create a new role to access the delivery stream. Click Next.

   

7. Review the configuration and click Create rule.

   

After you create the rule, EventBridge sends each Trusted Advisor event to the specified S3 bucket. Make sure you enable the Trusted Advisor service, as described in the next section; otherwise, you won't get any data.

AWS Trusted Advisor configuration

1. On your AWS console, search for trusted advisor in the search bar or go to Services > Management & Governance > Trusted Advisor.

   

2. Go to Manage Trusted Advisor in the left menu and click Enabled.

   

After you enable it, Trusted Advisor reviews the different checks for the AWS account. Check the official AWS documentation to learn more about the available Trusted Advisor checks.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

The policies below follow the principle of least privilege, so they give the AWS IAM user only the minimum permissions it needs.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

To delete the log files after Wazuh collects them, use the following policy instead:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

Wazuh deletes the log files from the bucket only if you set remove_from_bucket to yes in the bucket configuration. This option is off by default and isn't in the sample configuration, so you need the second policy only if you turn it on.

After creating a policy, you can attach it directly to a user or to a group the user belongs to. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on using other methods is available in the AWS documentation.