Install and Configure AWS Cloudtrail

Written by Alex DiMuzio on the 25th Aug 2021

1 - Download AWS CLI v2
2 - Create AWS Credentials File
3 - Create AWS Config File
4 - Configure AWS Components

Exported on 25-Aug-2021 18:18:58

Using Attune to install and configure the AWS Cloudtrail

This blueprint configures Cloudtrail for AWS using bash. It has been tested successfully on Ubuntu, using on any other platform would just require a change in the package manager in the AWS CLI install step. Cloudtrail is used to audit all activity and changes made within your AWS account.

Pre-Blueprint Attune setup

Inputs needed:

/: Host to run scripts on as well as credentials to connect * Text inputs for AWS Account ID (AWSAccountID), AWS Access Key (AccessKey), Access Secret Key (SecretKey), Output format (AWSOutputFormat), S3 bucket name (CloudtrailBucketName) and CloudTrail name (CloudtrailName)

Blueprint Steps

/: 1. First we use Ubuntu's native package manager to install the AWS CLI. This is a library of commands that can be used to interact with your AWS account. 2. The AWS CLI references an AWS credentials file in the home directory of the user running the commands. We use our access key and secret key inputs to pass these into that file. The CLI tools then use these credentials to authenticate to your AWS account. 3. Similar to the credentials file, the commands also look at an AWS config file to determine which region to default to, what output to use when running commands etc. We pass the region and output format inputs into this file. 4. Next, we have a group step that does all of the configuration for the AWS resources. See the comments in each step for more details. /

Parameters

Name	Type	Script Reference	Comment
AWSAccountID	Text	awsaccountid
AWSOutputFormat	Text	awsoutputformat
AWSRegion	Text	awsregion
AccessKey	Text	accesskey	This is an access key for AWS IAM User
CloudtrailBucketName	Text	cloudtrailbucketname
CloudtrailName	Text	cloudtrailname
Host_Creds	Linux OS Credential	host_creds
Hostname	Linux / Unix Server	hostname
SecretKey	Text	secretkey	This is a secret key for AWS IAM User

1 - Download AWS CLI v2

The connection details have changed from the last step.

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

#get latest version of packages
sudo apt update -y

#install awscli package
sudo apt install awscli -y

2 - Create AWS Credentials File

This step has the following parameters

Name	Script Reference	Default Value
AccessKey	{accesskey.value}	None
SecretKey	{secretkey.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

#create hidden aws directory in our home dir
mkdir ~/.aws

#create credentials file to store our access and secret keys
touch ~/.aws/credentials

#set our credentials
echo "[default]" > ~/.aws/credentials
echo "aws_access_key_id={accesskey.value}" >> ~/.aws/credentials
echo "aws_secret_access_key={secretkey.value}" >> ~/.aws/credentials

3 - Create AWS Config File

This step has the following parameters

Name	Script Reference	Default Value
AWSOutputFormat	{awsoutputformat.value}	None
AWSRegion	{awsregion.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

#create config file to store our AWS CLI preferences
touch ~/.aws/config
echo "[default]" > ~/.aws/config
echo "region={awsregion.value}" >> ~/.aws/config
echo "output={awsoutputformat.value}" >> ~/.aws/config

4 - Configure AWS Components

4.1 - Create Bucket Policy File

In order to securely configure the S3 bucket, we need to create a bucket policy. This policy configuration was pulled from https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html. We pass our bucket name and account ID inputs into the configuration.

This step has the following parameters

Name	Script Reference	Default Value
AWSAccountID	{awsaccountid.value}	None
CloudtrailBucketName	{cloudtrailbucketname.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

#create a file in the /tmp directory named bucket.json. This is where we will configure our S3 bucket policy
sudo touch /tmp/bucket.json

#pass everything from the 2nd line until the final EOF signal into the file we created. This is our bucket policy in JSON format
sudo cat <<EOF > /tmp/bucket.json 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck20150319",
            "Effect": "Allow",
            "Principal": {"Service": "cloudtrail.amazonaws.com"},
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::{cloudtrailbucketname.value}"
        },
        {
            "Sid": "AWSCloudTrailWrite20150319",
            "Effect": "Allow",
            "Principal": {"Service": "cloudtrail.amazonaws.com"},
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::{cloudtrailbucketname.value}/AWSLogs/{awsaccountid.value}/*",
            "Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
        }
    ]
}
EOF

4.2 - Create S3 Bucket for Cloudtrail

Now that we have determined our bucket policy, we need to create our bucket. This bucket is where Cloudtrail is going to store all of its audit logs. We pass our preferred region and bucket name inputs into the command to name the bucket and choose where it will be located.

This step has the following parameters

Name	Script Reference	Default Value
AWSRegion	{awsregion.value}	None
CloudtrailBucketName	{cloudtrailbucketname.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

aws s3api create-bucket --bucket {cloudtrailbucketname.value} --region {awsregion.value}

4.3 - Apply Policy to Bucket

We have created the bucket as well as the bucket policy file, now we need to apply the policy to the bucket to secure it and grant Cloudtrail access to write to it. We use the s3api command to do this. and pass in the bucket name as well as the json file we created to apply the policy.

This step has the following parameters

Name	Script Reference	Default Value
CloudtrailBucketName	{cloudtrailbucketname.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

aws s3api put-bucket-policy --bucket {cloudtrailbucketname.value} --policy file:///tmp/bucket.json

4.4 - Create Cloudtrail

The second to last step is creating the actual Trail itself. This is the configuration that tells AWS to log all audit data to our S3 bucket. This is necessary to maintain a full audit trail of everything that happens in our AWS account. We pass in our cloudtrailname and cloudtrailbucketname inputs, and the --is-multi-region-trail switch tells AWS that we want to audit activity in all regions of our AWS account.

This step has the following parameters

Name	Script Reference	Default Value
CloudtrailName	{cloudtrailname.value}	None
CloudtrailBucketName	{cloudtrailbucketname.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

aws cloudtrail create-trail --name {cloudtrailname.value} --s3-bucket-name {cloudtrailbucketname.value} --is-multi-region-trail

4.5 - Enable Cloudtrail Logging

Our final step enables logging for Cloudtrail. Although we configured everything, this step is necessary to turn the audit logging on.

This step has the following parameters

Name	Script Reference	Default Value
CloudtrailName	{cloudtrailname.value}	None

Connect via SSH

ssh user@hostname

This is a Bash Script make sure you run it with bash -l from a terminal session

aws cloudtrail start-logging --name {cloudtrailname.value}