Cloud Management Console Monitoring & Configuration Audit

Introduction

F5 Distributed Cloud App Infrastructure Protection (AIP) users can automatically set up an Amazon Web Service (AWS) integration through the CloudFormation template. When this integration completes, Distributed Cloud AIP authenticates in AWS using a Distributed Cloud AIP AWS Account linked to an AWS IAM role. Distributed Cloud AIP can then increase visibility into EC2 instances, monitor and create alerts for CloudTrail events, and perform configuration audits for AWS.

Prerequisites

• Administrator access to your AWS account
• Access to the Distributed Cloud AIP console

Tip

Use side-by-side browser windows – one for AWS and one for Distributed Cloud AIP – to complete these instructions.

1. Begin Creation of Distributed Cloud AIP AWS Account

The Distributed Cloud AIP AWS account includes a unique account ID and external ID. These IDs link the Distributed Cloud AIP AWS account to the AWS configuration.

Note

You will complete the Distributed Cloud AIP AWS Account after completing the creation of the AWS IAM role.

1. Log into Distributed Cloud AIP.
2. In the left navigation pane, click Settings. The Settings page displays.
3. Click Integrations. The Integrations page displays.
   
   
4. In the AWS Integrations section, click the + Add AWS Integration button. The + Add AWS Integration dialog opens.

   Warning

   Do not close this dialog until the AWS integration is complete. The External ID is uniquely generated each time you add an AWS account and must match the value entered during the AWS integration. If you click the close button, then a confirmation message displays in which you must acknowledge the close.

   

2. Configure AWS Resources

Users use the Distributed Cloud AIP CloudFormation template to configure AWS resources for use by Distributed Cloud AIP. The Distributed Cloud AIP CloudFormation template creates the following:

• An SNS topic
• An SQS queue
• An S3 bucket
• CloudTrail integration
• Configuration Audit integration
• A third-party cross-account with an IAM role. The IAM role will be used to authenticate the Distributed Cloud AIP AWS account.

To configure AWS resources:

1. Log into the AWS console as an administrator.
2. In this document, click the Launch Stack button.

   
   

   The AWS CloudFormation window opens and the Select Template page displays.

   

3. On the top bar, from the region drop-down menu, select the appropriate region for deployment. By default, the selected region is N. Virginia.
4. Verify the Specify an Amazon S3 template URL radio button is selected and the field contains the “https://threatstack-cloudformation.s3.amazonaws.com/threatstack.json” path.

   Warning

   If you do not select the region in which the resources are located, then the integration will not successfully complete.

5. Click the Next button. The Specify Details page displays.

   
   

6. In the Parameters section, fill in the following fields:
   1. What is your provided Distributed Cloud AIP Account ID? – Copy and paste the Distributed Cloud AIP account ID from the Distributed Cloud AIP + Add AWS Integration dialog.
   2. What is your provided Distributed Cloud AIP External ID – Type or copy and paste the Distributed Cloud AIP external ID from the Distributed Cloud AIP + Add AWS Integration dialog.
   3. What is your desired S3 bucket name? – Type a name for the Distributed Cloud AIP S3 bucket to monitor. The S3 bucket is where Distributed Cloud AIP stores AWS events. The name must meet the following criteria:
      1. Unique across all of AWS. For example, if you name the S3 bucket "MyCompanyName," then no one else using AWS can create a "MyCompanyName" S3 bucket.
      2. Between 3 and 63 characters long
      3. Contain only a combination of lowercase letters, numbers, periods, and dashes.
      4. Is not the 101st S3 bucket for the AWS account.

         Note

         AWS accounts only support 100 S3 buckets. Contact AWS to increase the S3 bucket limit for the AWS account.

7. Click the Next button. The Options page displays.

   
   

8. Do not enter any information. Filling out these fields may interfere with the monitoring and alerting operations of Distributed Cloud AIP.
9. Click the Next button. The Review page displays.

   
   

10. Verify the information displayed.
11. In the Capabilities section, read the notification message and select the I acknowledged that AWS CloudFormation might create IAM resources check box.

    
    

12. Click the Create button. The IAM role creates. The CloudFormation page displays.
    
    

    

13. Click the Refresh button until the Status reads CREATE_COMPLETE.
14. Click the stack name, then expand Outputs. The Outputs section displays.
    
    

    

    Warning

    Do not close the CloudFormation window or the Outputs section. The displayed information is necessary for the next step in the AWS integration.

3. Add AWS Account to Distributed Cloud AIP

Completing the Distributed Cloud AIP AWS Account allows Distributed Cloud AIP to authenticate in AWS using the IAM role.

1. Go to the Distributed Cloud AIP + Add AWS Integration dialog from which you copied the account ID and external ID.

   
   

2. In the Role ARN field, copy and paste the Role ARN value from the CloudFormation Outputs section.
3. In the Description field, type a description of the Distributed Cloud AIP AWS role. Type a description that identifies how the bucket relates to the AWS account, such as "production."
4. In the EC2 Correlation section, from the Select Regions drop-down menu, select the region(s) in which your organization has an EC2 presence.

   
   

5. Select the CloudTrail Integration check box. The CloudTrail fields become available.
6. In the SQS Name (Source) field, copy and paste the SQS Queue value from the CloudFormation Outputs section.
7. In the S3 Bucket field, copy and paste the S3 Bucket value from the CloudFormation Outputs section.
8. From the Select Regions drop-down menu, select the region(s) in which you deployed the CloudFormation template (Configure AWS Resources, step 3).

   Warning

   Selecting incorrect regions causes the authentication of Distributed Cloud AIP in AWS using the IAM role for Cloud Trail to fail. Double-check your region selection.

9. Select the Configuration Auditing check box. The Configuration Auditing field becomes available.
10. From the Select Regions drop-down menu, select the region(s) in which your organization has resources.
11. Verify the information entered and selected on the page is accurate.
12. Click the Add AWS Integration button. The + Add AWS Integration dialog closes. The Integrations page displays. A “Account Added Successfully” message displays and the new AWS account displays in the AWS Integrations table. A clock icon displays in the EC2 Correlation Status column, indicating the account is authenticating with AWS. This process may take several minutes.

    
    

4. Confirm Successful Distributed Cloud AIP Integration with AWS

In the Settings > Integrations tab > AWS Integrations table, in the row for the AWS account, in the EC2 Correlation Status column, a green checkmark displays. That checkmark confirms that Distributed Cloud AIP successfully authenticated in AWS using the IAM role created for AWS.

Next Steps

1. Perform your first Configuration Audit of AWS.
2. Get Started with CloudTrail Alerting.

   Note

   Distributed Cloud AIP syncs CloudTrail events per customer every four minutes, and EC2 sync events per customer every eight minutes.