Integrating with AWS CloudTrail

Before you begin

Before configuring AWS CloudTrail, we recommend reviewing Getting started with Blumira's AWS security monitoring.

CloudTrail Configuration

1. In the AWS console, navigate to the CloudTrail service. If this is the first time you have configured CloudTrail, select Create a trail from the welcome screen.
   Note: If you have already used CloudTrail in your environment, you can skip to Step 3.
   
2. From the “Quick Trail” configuration screen, select Create full trail.
3. Open CloudTrail from the AWS console and select Create trail
4. Enter the configuration for CloudWatch logs to enable sending CloudTrail logs to CloudWatch, allowing the service to create a service role to enable CloudTrail the permissions to put log data into the CloudWatch log group.
5. Click Next.
6. Select which types of CloudTrail events to log. Blumira recommends: Management events, Insights events, and Data events including S3, Lambda, and DynamoDB.
   
7. Click Create trail.

S3 Housekeeping Lifecycle Policy

1. In the AWS console, go to S3 and select the S3 bucket created for CloudTrail logging.
2. Select the management tab and click Create lifecycle rule.
   
3. Enter a name for the lifecycle rule and under Choose a rule scope, select the radio button to apply the rule to all objects in the bucket.
   
4. Set the lifecycle policy to expire current versions of objects and permanently delete any previous version of objects after 1 day.
5. Click Create rule.

Now that you’ve configured CloudTrail for Blumira, continue to the next step in configuring AWS for Blumira: configure AWS CloudWatch.