Cloud ConnectorsExabeam Cloud Connectors Configuration Guide

Collect all the account numbers that will be sending CloudTrail events.

Find your Account # in My Account under Account Settings > Account ID. The account number is a 12 digit number, for example 111111111111.

In the account you want to set up to receive the trails (for the duration of this procedure, we use Account A as an example of the account name), create an S3 bucket.

Record the ARN for the bucket (see the properties tab).

Create an SQS queue (Standard).

Record the URL.

Set a policy for the SQS Queue to allow only the S3 bucket to send events to it:

1. In SQS, select the queue and then Permissions.

2. Click Edit Policy Document (Advanced).

3. Paste the following policy and modify it for your environment.

    { 
           "Version": "2012-10-17", 
           "Id": "queue ARN/SQSDefaultPolicy", 
           "Statement": [ 
               { 
               "Effect": "Allow", 
               "Principal": { 
                   "AWS": "*" 
               }, 
               "Action": ["SQS:SendMessage"], 
               "Resource": "queue ARN", 
               "Condition": { 
                   "ArnLike": { 
                   "aws:SourceArn": "bucket ARN" 
                   } 
               } 
               } 
           ] 
     } 

Configure the S3 Bucket to notify the SQS Queue when files are added to it:

1. In S3, select the Properties tab for the bucket.

2. Select Events > Add notification.

3. Enter a meaningful name (i.e. “Notify SQS new Files”).

4. Select ObjectCreate (All).

5. Under Send to, select SQS Queue.

6. Select the queue and then Save your changes.

Set a policy for the S3 Bucket to allow only the accounts for which you want to send CloudTrail events to this bucket to add objects to it:

1. In S3, select the bucket > Permissions > Bucket Policy.

2. Paste the following policy and modify it to add a row with the account ID for each source account:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
           "Effect": "Allow",
           "Principal": {
               "Service": "cloudtrail.amazonaws.com"
           },
           "Action": "s3:GetBucketAcl",
           "Resource": "Bucket ARN"
           },
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "cloudtrail.amazonaws.com"
               },
               "Action": "s3:PutObject",
               "Resource": [
                   "Bucket ARN/[optional] myLogFilePrefix/AWSLogs/Account ID 1/*",
                   "Bucket ARN/[optional] myLogFilePrefix/AWSLogs/Account ID 2/*"
               ],
               "Condition": { 
                   "StringEquals": { 
                   "s3:x-amz-acl": "bucket-owner-full-control" 
                   }
               }
           }
       ]
   }
   

Configure a CloudTrail for each account to send its events to the bucket in Account A.

1. Log in to the desired account.

2. In CloudTrail, create a new trail (or re-configure an existing one).

3. Under Storage location select No in Create new bucket and set the bucket name (not ARN) of Account A.

Choose your preferred authentication method:

Exabeam Cloud Connectors provides three authentication options for authentication with AWS:

1. InstanceProfile: This is the recommended authentication method if the instance where cloud connector is running is in AWS EC2 and the AWS account we want to collect data from is the same as the one where the machine is hosted.

   To use this method, you will need to create and IAM policy and assign it to a role, then assign the role with the required permissions to the EC2 instance running the Exabeam Cloud Connectors.

   For more information, see the following AWS documentation: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html.

2. STSAssumeRole: This is the recommended method for authentication by AWS. It also allows for cross-account access.

   The credentials for the IAM user (i.e. Basic) are used to authenticate with the user that will then assume the role. That user does not need any other permission other than the ability to assume the role specified.

   For more information, see the following AWS documentation: https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html.

3. Basic: Authenticates using the access key and secret of an IAM User.

For any of the above methods, an IAM Policy is needed.

Create IAM Policy:

1. In your AWS console, select Services > IAM > Policies > Create policy.

2. Click on the JSON tab, to get an online editor.

3. Replace the default, empty JSON with the following JSON

4. Modify the JSON as appropriate and edit the name the policy (for example SQS and S3 for Exabeam Cloud Connectors).

   { 
   "Version": "2012-10-17", 
   "Statement": [ 
       { 
       "Action": [ 
           "sqs:DeleteMessage", 
           "sqs:DeleteMessageBatch", 
           "sqs:ReceiveMessage" 
       ], 
       "Effect": "Allow", 
       "Resource": "Queue ARN" 
       }, 
       { 
       "Action": [ 
           "s3:GetObject" 
       ], 
       "Effect": "Allow", 
       "Resource": "Bucket ARN/*" 
       } 
     ] 
   } 

(Basic and AssumeRole Authentication only) Create an IAM user.

Create a user with the policy from step 6:

In Account A:

1. In your AWS console, navigate to Services > IAM > Users > Add user.

2. Give your user a name and enable programmatic access for the account.

   

3. When you click next, you will be transferred to the set permissions page.

4. (Basic Authentication only) Choose Attach Existing Policies Directly and search for the policy you created in the previous step.

   For STSAssumeRole authentication, skip this step as you will be warned about user has no permissions (this is okay).

5. Continue the user creation process (tags are optional) and finish the user creation. You will see a screen like the following :

   

6. Note the following attributes which you will need to create an IAM role.

   

   • Access Key ID (e.g. see in the diagram an example)

   • Secret Access Key (e.g. see in the diagram an example)

(AssumeRole and InstanceProfile authentication only) Create an IAM role:

1. Navigate to IAM > Roles and click Create Role.

2. Enable the AWS Service and EC2 service, and then click Next: Permissions.

   This will create a trust relationship that allows EC2 instances to call AWS services on your behalf. Later in this procedure, you will modify the trust relationship per the authentication method of your choice.

3. Search and then select the policy you created, and then click Next: Tags.

4. (Optional) Add tags if desired and then click Next: Review.

5. Give the role a meaningful name, e.g. ExabeamCCAWSConnectorRole, and description and then click Create Role.

6. Search and then select the role you created.

7. Record the ARN for the role.

8. Finalize the AssumeRole and InstanceProfile authentication configuration:

   AssumeRole

   1. Navigate to IAM > Roles and search for the role created earlier.

   2. Allow a specific user to use (assume) the role:

      1. Go to the Trust relationships tab, click Edit trust relationship.

      2. Make sure the Statements array contains the following entry (modify accordingly):

         {
           "Effect": "Allow",
           "Principal": {
             "AWS": "arn:aws:iam::123456789012:user/ccuser"
           },
           "Action": "sts:AssumeRole"
          }

      3. Click Update Trust Policy.

   InstanceProfile

   1. Navigate to IAM > Roles and search for the role created earlier.

   2. Allow EC2 instances to use (assume) the role.

      1. Go to the Trust relationships tab, click Edit trust relationship.

      2. Make sure the Statements array contains the following statement entry:

         {
           "Effect": "Allow",
           "Principal": {
             "Service": "ec2.amazonaws.com"
           },
           "Action": "sts:AssumeRole"
          }

      3. Click Update Trust Policy.

   3. Navigate to AWS EC2 service.

   4. Right-click on the instance where Exabeam Cloud Connectors in installed.

   5. Click Instance Settings > Attach/Replace IAM Role.

   6. Choose the role from the drop-down list, and Apply.

Proceed to Configure the AWS Multi-Tenant Cloud Connector.