|
In November 2013, we declared AWS CloudTrail to track person activity and API use. AWS CloudTrail enables auditing, stability monitoring, and operational troubleshooting. CloudTrail information person action and API calls across AWS solutions as gatherings. CloudTrail functions aid you solution the questions of “who did what, wherever, and when?”.
Not too long ago we have enhanced the potential for you to simplify your auditing and security evaluation by applying AWS CloudTrail Lake. CloudTrail Lake is a managed knowledge lake for capturing, storing, accessing, and examining consumer and API action on AWS for audit, stability, and operational purposes. You can combination and immutably shop your exercise activities, and operate SQL-based mostly queries for search and assessment.
We have listened to your suggestions that aggregating exercise details from numerous apps throughout hybrid environments is elaborate and highly-priced, but crucial for a extensive photograph of your organization’s security and compliance posture.
Now we are announcing assistance of ingestion for action activities from non-AWS resources using CloudTrail Lake, building it a single location of immutable user and API action functions for auditing and stability investigations. Now you can consolidate, immutably keep, search, and evaluate activity events from AWS and non-AWS sources, this kind of as in-home or SaaS applications, in 1 put.
Working with the new PutAuditEvents API in CloudTrail Lake, you can centralize user activity facts from disparate resources into CloudTrail Lake, enabling you to review, troubleshoot and diagnose difficulties making use of this details. CloudTrail Lake documents all gatherings in standardized schema, producing it easier for users to consume this information and facts to comprehensively and immediately respond to stability incidents or audit requests.
CloudTrail Lake is also built-in with picked AWS Companions, this kind of as Cloud Storage Protection, Clumio, CrowdStrike, CyberArk, GitHub, Kong Inc, LaunchDarkly, MontyCloud, Netskope, Nordcloud, Okta, One Identification, Shoreline.io, Snyk, and Wiz, making it possible for you to effortlessly allow audit logging via the CloudTrail console.
Acquiring Begun to Integrate External Sources
You can commence to ingest action occasions from your possess knowledge resources or lover programs by deciding on Integrations below the Lake menu in the AWS CloudTrail console.
To make a new integration, choose Include integration and enter your channel title. You can decide on the husband or wife application source from which you want to get situations. If you are integrating with gatherings from your have programs hosted on-premises or in the cloud, decide on My personalized integration.
For Function shipping and delivery location, you can opt for places for your events from this integration. This will allow your software or associates to supply activities to your event info retailer of CloudTrail Lake. An function info store can keep your exercise situations for a week to up to seven many years. Then you can operate queries on the function info store.
Opt for either Use current event details outlets or Generate new party facts retail outlet—to obtain situations from integrations. To discover far more about occasion details retail store, see Produce an celebration facts retailer in the AWS documentation.
You can also set up the permissions coverage for the channel resource designed with this integration. The data needed for the plan is dependent on the integration style of every single companion purposes.
There are two forms of integrations: direct and remedy. With immediate integrations, the husband or wife phone calls the PutAuditEvents API to produce events to the occasion data retail outlet for your AWS account. In this case, you will need to provide External ID, the distinctive account identifier furnished by the spouse. You can see a website link to husband or wife web site for the action-by-step guide. With option integrations, the application operates in your AWS account and the application phone calls the PutAuditEvents API to deliver occasions to the occasion information retailer for your AWS account.
To come across the Integration style for your associate, pick the Readily available sources tab from the integrations web site.
Right after making an integration, you will have to have to give this Channel ARN to the source or associate software. Until eventually these steps are finished, the position will continue to be as incomplete. The moment CloudTrail Lake commences acquiring occasions for the integrated partner or application, the status field will be updated to reflect the recent condition.
To ingest your application’s activity activities into your integration, call the PutAuditEvents API to incorporate the payload of gatherings. Be absolutely sure that there is no sensitive or individually pinpointing info in the celebration payload just before ingesting it into CloudTrail Lake.
You can make a JSON array of celebration objects, which incorporates a demanded user-produced ID from the event, the necessary payload of the event as the value of EventData, and an optional checksum to assistance validate the integrity of the occasion after ingestion into CloudTrail Lake.
"AuditEvents": [
"Id": "event_ID",
"EventData": "event_payload", "EventDataChecksum": "optional_checksum",
,
... ]
The subsequent example displays how to use the place-audit-functions AWS CLI command.
$ aws cloudtrail-facts place-audit-functions
--channel-arn $ChannelArn
--exterior-id $UniqueExternalIDFromPartner
--audit-occasions
"Id": "87f22433-0f1f-4a85-9664-d50a3545baef",
"EventData":""eventVersion":.01","eventSource":"MyCustomLog2", ...",
,
"Id": "7e5966e7-a999-486d-b241-b33a1671aa74",
"EventData":""eventVersion":.02","eventSource":"MyCustomLog1", ...",
"EventDataChecksum":"848df986e7dd61f3eadb3ae278e61272xxxx",
On the Editor tab in the CloudTrail Lake, create your very own queries for a new integrated function knowledge shop to look at shipped activities.
You can make your own integration question, like acquiring all principals throughout AWS and exterior methods that have made API calls after a particular date:
Find userIdentity.principalId FROM $AWS_Celebration_Info_Retail store_ID
The place eventTime > '2022-09-24 00:00:00'
UNION ALL
Select eventData.userIdentity.principalId FROM $Spouse_Occasion_Information_Retail store_ID
WHRERE eventData.eventTime > '2022-09-24 00:00:00'To study additional, see CloudTrail Lake party schema and sample queries to assistance you get commenced.
Start Companions
You can see the record of our launch partners to support a CloudTrail Lake integration selection in the Obtainable resources tab. Listed here are blog posts and announcements from our associates who collaborated on this launch (some will be additional in the next handful of times).
Now Out there
AWS CloudTrail Lake now supports ingesting action occasions from exterior resources in all AWS Areas exactly where CloudTrail Lake is offered these days. To discover much more, see the AWS documentation and every partner’s finding started guides.
If you are intrigued in starting to be an AWS CloudTrail Husband or wife, you can speak to your usual companion contacts.
– Channy