Amazon Security Lake

Logging in and navigating

1. Log into your AWS console and navigate to Security Lake.

2. Navigate to Subscribers, and click Create subscriber.

Creating a subscriber

1. Enter a descriptive name for your subscriber. For example, Wazuh.

2. Choose to either collect all log and event sources, or only specific log and event sources.

3. Select S3 as your data access method.

4. Enter the AWS account ID for the account you are currently logged into.

5. Enter a unique value in External ID. For example, wazuh-external-id-value.

6. Under Notification details select SQS queue.

7. Click the Create button to get to the Subscribers pages.

Reviewing the subscriber

1. Navigate to My subscribers section, and click on your newly created subscriber to get to the Subscriber Details page.

2. Check that AWS created the subscriber with the correct parameters.

3. Save the SQS queue name. You need the name of the Subscription endpoint for later on when verifying the information in the SQS queue.

Configuring the role

Follow these steps to modify the Security Lake subscriber role. You have to associate an existing user with the role.

1. In your AWS console, navigate to the Amazon IAM service.

2. In your Amazon IAM service, navigate to the Roles page.

3. In the Roles page, select the Role name of the subscription role notification that was created as part of the Security Lake subscriber provisioning process.

4. In the Summary page, navigate to the Trust relationships tab to modify the Trusted entity policy.

5. Modify the Trusted entity policy with the following updates:

   1. In the stanza containing the ARN, attach the username from your target user account to the end of the ARN. This step connects a user to the role. It lets you configure the Security Lake service with the secret access key. See the following Trusted entity example:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "1",
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam::<account-id>:user/<user-account>"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                       "StringEquals": {
                           "sts:ExternalId": [
                               "wazuh-external-id-value"
                           ]
                       }
               }
           }
       ]
   }
   

Granting a user permissions to switch roles

Follow these steps to configure the user permissions:

1. In your Amazon IAM service, navigate to the Users page.

2. In the Users page, select the Username of the user you have connected to the role (<account-id>).

3. Replace <account-id> and <resource-role>, and add the following permission to switch to the new role:

   Note that <resource-role> is the name of the subscription role that was created as part of the Security Lake subscriber provisioning process.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
           "Sid": "VisualEditor1",
           "Effect": "Allow",
           "Action": "sts:AssumeRole",
           "Resource": "arn:aws:iam::<account-id>:role/<resource-role>"
           }
       ]
   }
   

Queue configuration

• <sqs_name> : The name of the queue.

• <service_endpoint>- Optional: The AWS S3 endpoint URL to be used to download the data from the bucket. Check Considerations for configuration for more information about VPC and FIPS endpoints.

Authentication

• <iam_role_arn>: ARN for the corresponding IAM role to assume.

• <external_id>: External ID to use when assuming the role.

• <iam_role_duration> - Optional: The session duration in seconds.

• <sts_endpoint> - Optional: The URL of the VPC endpoint of the AWS Security Token Service.

  Note

  This authentication method requires adding credentials to the configuration using the /root/.aws/credentials file.

More information about the different authentication methods can be found in the Configuring AWS credentials documentation.