Page Comparison

Note that data will be available to Devo and your policies will follow AWS recommended best practices.

Please visit the vendor documentation for more needed details.

1. Create a list of this information.

   1. AWS Partition. For example, aws.

   2. AWS Region. For example, us-east-1.

   3. Your AWS Account. For example, 012345678901.

   4. S3 Principal Service endpoint. This is almost always s3.amazonaws.com but GovCloud FIPS is a known exception.

   5. S3 bucket name. You can make one up, such as BucketCloudTrailDevo if you are authorizing access to CloudTrail data.

   6. SQS name. You can make one up, such as SQSCloudTrailDevo.

   7. IAM policy name. Make this the same as the SQS name.

   8. Role name. Make this the same as the SQS name.

   9. External ID. Get the External ID from the Cloud Collector App. Select Keychains.

      Image Modified

      The external ID is your Devo domain name and default sender’s syslog event load balancer, separated by a .. For example, if your Devo domain name is child@parent and you use the us.elb.relay.logtrust.net event load balancer, then your external ID is child@parent.us.elb.relay.logtrust.net.

   10. Collector name. You can make one up. If your Devo domain is child@parent, the collector name could be child-parent-sqs-CloudTrailDevo.

Create an S3 bucket using the default settings. Use a separate bucket for each log format, if possible.

Image Modified

1. Create a standard SQS queue named devo_deadletter_queue. Use the default settings.

Image Modified

2. Create a second standard SQS queue using your queue name. This will be the queue used to send data to Devo.

3. Select the maximum retention period.

   Image Modified

1. Set the following SQS access policy, replacing the values enclosed in < >.

Image Modified

{
  "Version": "2012-10-17",
  "Id": "<ENSURE_THE_ID_IS_UNIQUE>",
  "Statement": [
    {
      "Sid": "AllowS3toSendMessages",
      "Effect": "Allow",
      "Principal": {
        "Service": "<S3_PRINCIPAL_SERVICE_ENDPOINT>"
      },
      "Action": [
        "SQS:SendMessage"
      ],
      "Resource": "arn:<PARTITION>:sqs:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:<QUEUE_NAME>",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:<PARTITION>:s3:*:*:<BUCKET_NAME>"
        },
        "StringEquals": {
          "aws:SourceAccount": "<YOUR_AWS_ACCOUNT_NUMBER>"
        }
      }
    }
  ]
}

2. An example resource is arn:aws:sqs:us-east-1:0123456789:devologs.

3. Enable the dead-letter queue named devo_deadletter_queue.

   Image Modified

4. Keep the defaults for the other SQS settings.

5. Return to the S3 Bucket

1. Create an IAM Policy.

Image Modified

2. Add this JSON Policy.

Image Modified

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes",
        "sqs:ChangeMessageVisibility",
        "sqs:ReceiveMessage"
      ],
      "Resource": [
        "arn:<PARTITION>:sqs:<REGION>:<YOUR_AWS_ACCOUNT_NUMBER>:<QUEUE_NAME>",
        "arn:<PARTITION>:s3:::<BUCKET_NAME>/*"
      ]
    }
  ]
}

3. Click Next.

4. Name the policy.

5. Create the policy.

Create a role.

Image Modified

1. Select Custom trust policy.

Image Modified

2. Set the trust policy.

   1. If your partition is aws:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::476382791543:role/devo-xaccount-cc"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}

b. If your partition is aws-us-gov:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws-us-gov:iam::210253767148:role/devo-xaccount-cc"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID>"
        }
      }
    }
  ]
}

3. Add the permissions policy you already created to the role.

Image Modified

4. Name the role.

Image Modified

Once the authorization process is complete, you can create a Devo collector and add data to the S3 Bucket.