Logging and Monitoring Flashcards
What does Cloudtrail not log?
API calls only, NOT SSH/RDP into instances etc.(Use VPC flowlogs to capture network IP traffic)
What does cloudTrail log?
metadata, identity of requester, time, source IP, request parameters and response from the service
How often are event logs delivered to S3?
every 5 minutes, with a delay of up to 15 min from the time a request was made
What is the thing about Cloudtrail?
enabled by default on all accounts for 90 days, but put in an AWS-owned S3 bucket NOT yours
How can management events be enabled?
For read-only (DescribeInstance) or Write-only (CreateBucket) or all
What are data events ?
for S3 object-level activity like GetObject and PutObject — can get expensive!
What does Cloudtrail do every hour?
puts a digest file in S3 which has hashes that can be used to validate integrity of log files
How to give auditors access to Cloudtrail?
Auditors can be given access to Cloudtrail by creating a user for them with IAM CloudtrailReadOnly policy
How can Cloudtrail log files be protected?
1) IAM
2) bucket policy
3) MFA delete + set up log file validation
How often is CloudWatch detailed monitoring?
Cloudwatch detailed monitoring is every 1 min refresh, standard is every 5 min
Cloudwatch Events can ingest events from?
1) Cloudtrail
2) resource state change (Instance stopped)
3) scheduled events (cron)
4) custom events, can have Rules to match on events, and Targets (eg: Lambda)
What does putMetricData API do?
publishes metric data points to Amazon CloudWatch that allows you to monitor your applications better.
How to setup alert if a root user logs in:
- Set up a Cloudtrail trail to send logs to Cloudwatch Log group
- In Cloudwatch Logs, select the log group and create Metric Filter with filter pattern matching “userIdentity.type = Root” and other conditions like eventType != ServiceEvent (root user does a thing, it’s not AWS doing things)
- On the Filter, create an Alarm - when >=1 occurrence, send notification to email/SNS topic
What is VPC Flow Logs?
a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Take note that it only captures the metadata of the traffic and not the actual IP packet data itself. Flow log data can be published to Amazon CloudWatch Logs or Amazon S3.
Where can you create a VPC flow log?
You can create a flow log for a VPC, a subnet, or a network interface. If you create a flow log for a subnet or VPC, each network interface in that subnet or VPC is monitored.
What are flow log records?
Flow log data for a monitored network interface is recorded as flow log records, which are log events consisting of fields that describe the traffic flow.
Where do VPC flow logs get stored?
Cloudwatch logs
Where can VPC flow logs be enabeld?
VPC flow logs can be enabled at entire VPC level, subnet level or ENI level
What do VPC flow logs not monitor?
1) traffic generated by EC2 contacting Amazon DNS
2) Windows license activation traffic
3) instance metadata traffic to 169.254.169.254
4) DHCP traffic
5) VPC router reserved IP traffic
What does AWS Config provide?
1) resource inventory
2) configuration history eg: what was my SG 2 weeks ago 3) configuration change notifications
What happens when something triggers in AWS Config?
When something changes, it triggers a Config Event saved in your S3, triggers a Rule which can send notifications
What’s the thing about AWS Config?
Config has to be explicitly turned on per region
What is config timeline?
Config Timeline is a cool feature- can click on any resource and get history of all changes made to it
What roles does AWS Config need?
Config needs an IAM role that has read permission for all resources, access to S3 and publish access to SNS
Do CloudHSM and KSM both support symmetric and assymmetric?
Yes
How can you have a custom key store for KMS keys?
Use CloudHSM/
When will CloudHSM erase itself?
If CloudHSM detects 5 failed attempts to access partitions as a Crypto Officer (CO) role, it will erase itself.
5 failed attempts by a Crypto User (CU) will lock the user and Officer has to unlock them
What can Crypto-officer in CloudHSm do?
CO can perform user management operations (create and delete users, change user passwords).
What can Crypto-user in CloudHSM do?
perform key management (create, delete, share, import, and export cryptographic keys) and cryptographic operations(encryption, decryption, signing, verifying, and more).
What does AWS Inspector classic do?
assesses applications for security vulnerabilities and gives list of findings. Trusted Advisor does it for resources
What does AWS Inspector need?
IAM role with read-only access to EC2, and an agent to be deployed on EC2
What does Inspector classic need at least?
1 tag on EC2 instance to identify target
What are some of the AWS INspector templates?
CIS OS Benchmark, Common Vulnerabilities, Network Reachability Assessments etc. Pick a template and remember to “Run” it for 1hr or more. Can download report that lists all checks it did and pass/fail
