AWS Trusted Advisor

AWS Trusted Advisor helps users optimize their AWS environment by following AWS best practices to provide real-time guidance that aims to reduce cost, increase performance, and improve security. Trusted Advisor logs can be stored in an S3 bucket thanks to Amazon EventBridge and Amazon Data Firehose, allowing Wazuh to process them and generate alerts using the built-in rules Wazuh provides, as well as any custom rules available.

Note

You must have a Business, Enterprise On-Ramp, or Enterprise AWS Support plan to create an EventBridge rule for Trusted Advisor checks. For more information, see changing AWS support plans.

AWS configuration

The following sections cover how to configure the different services required to integrate Trusted Advisor into Wazuh.

Amazon Data Firehose configuration

Create an Amazon Data Firehose delivery stream to store the Trusted Advisor logs into the desired S3 bucket so Wazuh can process them.

  1. Create a new S3 bucket. If you want to use an already existing one, skip this step.

  2. On your AWS console, Search for "amazon data firehose" in the search bar at the top of the page or go to Services > Analytics > Amazon Data Firehose.

  3. Click Create Firehose stream.

  4. Select Direct PUT and Amazon S3 as the desired Source and Destination, respectively.

  5. Choose an appropriate Firehose stream name.

  6. Select the desired S3 bucket as the destination. It is possible to specify a custom prefix to alter the path where AWS stores the logs. AWS Firehose creates a file structure YYYY/MM/DD/HH, if a prefix is used the created file structure would be prefix-name/YYYY/MM/DD/HH. If a prefix is used it must be specified under the Wazuh bucket configuration. In our case, the prefix is trusted-advisor/. Select your preferred compression, Wazuh supports any kind of compression but Snappy.

  7. Create or choose an existing IAM role to be used by Amazon Data Firehose in the Advanced settings section.

  8. Click Create Firehose stream at the end of the page. The new firehose stream will be created and its details will be shown as follows.

Amazon EventBridge configuration

Configure an Amazon EventBridge rule to send Trusted Advisor events to the Amazon Data Firehose delivery stream created in the previous step.

  1. On your AWS console, search for "eventbridge" in the search bar at the top of the page or navigate to Services > Application Integration > EventBridge.

  2. Click Create rule.

  3. Give a name to the EventBridge rule and select the Rule with an event pattern option.

  4. In the Build event pattern section, choose AWS events or EventBridge partner events as Event source.

  5. In the Event pattern section, choose AWS services as Event source, Trusted Advisor as AWS service, and All Events as Event type. Click Next to apply the configuration.

  6. Under Select a target, choose Firehose stream and select the stream created previously. Also, create a new role to access the delivery stream. Click Next to apply the configuration.

  7. Review the configuration and click Create rule.

Once the rule is created, every time a Trusted Advisor event is sent, it will be stored in the specified S3 bucket. Remember to first enable the Trusted Advisor service, otherwise, you won't get any data.

AWS Trusted Advisor configuration

  1. On your AWS console, search for "Trusted Advisor" in the search bar at the top of the page or navigate to Services > Management & Governance > Trusted Advisor.

  2. Go to Manage Trusted Advisor in the left menu and click on the Enabled button.

Once enabled, Trusted Advisor reviews the different checks for the AWS account. Check the official AWS documentation to learn more about the different Trusted Advisor checks available.

Policy configuration

Follow the creating an AWS policy guide to create a policy using the Amazon Web Services console.

Take into account that the policies below follow the principle of least privilege to ensure that only the minimum permissions are provided to the AWS IAM user.

To allow an AWS user to use the Wazuh module for AWS with read-only permissions, it must have a policy like the following attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
            ]
        }
    ]
}

If it is necessary to delete the log files once they have been collected, the associated policy would be as follows:

{
     "Version": "2012-10-17",
     "Statement": [
         {
             "Sid": "VisualEditor0",
             "Effect": "Allow",
             "Action": [
                 "s3:GetObject",
                 "s3:ListBucket",
                 "s3:DeleteObject"
             ],
             "Resource": [
                 "arn:aws:s3:::<WAZUH_AWS_BUCKET>/*",
                 "arn:aws:s3:::<WAZUH_AWS_BUCKET>"
             ]
         }
     ]
 }

Note

<WAZUH_AWS_BUCKET> is a placeholder. Replace it with the actual name of the bucket from which you want to retrieve logs.

After creating a policy, you can attach it directly to a user or to a group to which the user belongs. In attaching a policy to an IAM user group, you see how to attach a policy to a group. More information on how to use other methods is available in the AWS documentation.

Configure Wazuh to process Amazon Trusted Advisor logs

  1. Access the Wazuh configuration in Server management > Settings using the Wazuh dashboard or by manually editing the /var/ossec/etc/ossec.conf file in the Wazuh server or agent.

  2. Add the following Wazuh module for AWS configuration to the file, replacing <WAZUH_AWS_BUCKET> with the name of the S3 bucket:

    <wodle name="aws-s3">
      <disabled>no</disabled>
      <interval>10m</interval>
      <run_on_start>yes</run_on_start>
      <skip_on_error>yes</skip_on_error>
      <bucket type="custom">
        <name><WAZUH_AWS_BUCKET></name>
        <path>trusted-advisor</path>
        <aws_profile>default</aws_profile>
      </bucket>
    </wodle>
    

    Note

    In this example, the aws_profile authentication parameter was used. Check the credentials section to learn more about the different authentication options and how to use them.

  3. Save the changes and restart Wazuh to apply the changes. The service can be manually restarted using the following command outside the Wazuh dashboard:

    • Wazuh manager:

      systemctl restart wazuh-manager
      
    • Wazuh agent:

      systemctl restart wazuh-agent