SEC04-BP01 Configure service and application logging
Configure logging throughout the workload, including application logs, resource logs, and AWS service logs. For example, ensure that AWS CloudTrail, Amazon CloudWatch Logs, Amazon GuardDuty and AWS Security Hub are enabled for all accounts within your organization.
A foundational practice is to establish a set of detection mechanisms at the account level. This base set of mechanisms is aimed at recording and detecting a wide range of actions on all resources in your account. They allow you to build out a comprehensive detective capability with options that include automated remediation, and partner integrations to add functionality.
In AWS, services that can implement this base set include:
AWS CloudTrail
provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. AWS Config
monitors and records your AWS resource configurations and allows you to automate the evaluation and remediation against desired configurations. Amazon GuardDuty
is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. AWS Security Hub
provides a single place that aggregates, organizes, and prioritizes your security alerts, or findings, from multiple AWS services and optional third- party products to give you a comprehensive view of security alerts and compliance status.
Building on the foundation at the account level, many core AWS services, for example
Amazon Virtual Private Cloud Console (Amazon VPC)
For Amazon Elastic Compute Cloud (Amazon EC2) instances and application-based logging that doesn’t originate from
AWS services, logs can be stored and analyzed using Amazon CloudWatch Logs
Equally important to collecting and aggregating logs is the ability to extract meaningful insight from the great volumes of log and event data generated by complex architectures. See the Monitoring section of the Reliability Pillar whitepaper for more detail. Logs can themselves contain data that is considered sensitive–either when application data has erroneously found its way into log files that the CloudWatch Logs agent is capturing, or when cross-region logging is configured for log aggregation and there are legislative considerations about shipping certain kinds of information across borders.
One approach is to use AWS Lambda functions, triggered on events when logs are delivered, to filter and redact log data before forwarding into a central logging location, such as an Amazon Simple Storage Service (Amazon S3) bucket. The unredacted logs can be retained in a local bucket until a reasonable time has passed (as determined by legislation and your legal team), at which point an Amazon S3 lifecycle rule can automatically delete them. Logs can further be protected in Amazon S3 by using Amazon S3 Object Lock, where you can store objects using a write-once-read-many (WORM) model.
Level of risk exposed if this best practice is not established: High
Implementation guidance
-
Enable logging of AWS services: Enable the logging of AWS services to meet your requirements. Logging capabilities include the following: Amazon VPC Flow Logs, Elastic Load Balancing (ELB) logs, Amazon S3 bucket logs, CloudFront access logs, Amazon Route 53 query logs, and Amazon Relational Database Service (Amazon RDS) logs.
-
Evaluate and enable logging of operating systems and application-specific logs to detect suspicious behavior.
-
Apply appropriate controls to the logs: Logs can contain sensitive information and only authorized users should have access. Consider restricting permissions to Amazon S3 buckets and CloudWatch Logs log groups.
-
Configure Amazon GuardDuty: GuardDuty is a threat detection service that continuously looks for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. Enable GuardDuty and configure automated alerts to email using the lab.
-
Configure customized trail in CloudTrail: Configuring a trail enables you to store logs for longer than the default period, and analyze them later.
-
Enable AWS Config: AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This view includes how the resources are related to one another and how they were previously configured so that you can see how the configurations and relationships change over time.
-
Enable AWS Security Hub: Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your compliance with the security industry standards and best practices. Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues.
Resources
Related documents:
Related videos:
Related examples:
