이 문서에서는 CloudTrail 로그를 저장할 새 S3 버킷을 만드는 방법과 AWS에서 로그 피드를 가져올 IAM 사용자를 만드는 방법을 설명합니다.
AWS Config는 AWS 계정의 AWS 리소스 구성에 관한 세부정보를 제공합니다. 여기에는 리소스 간의 관계와 과거 구성이 포함되어 시간이 지남에 따라 구성과 관계가 어떻게 변경되는지 확인할 수 있습니다.
값은 configurationItem.relationships.resourceType 필드에서 가져옵니다. 키가 'configurationItem.relationships.resource_types'로 설정됩니다.
configurationItem.resourceId
target.resource.id
값은 configurationItem.resourceId 필드에서 가져옵니다.
configurationItem.resourceType
target.resource.resource_subtype
값은 configurationItem.resourceType 필드에서 가져옵니다.
해당 사항 없음
metadata.event_type
configurationItemDiff.changeType가 'UPDATE'인 경우 metadata.event_type이 'RESOURCE_WRITTEN'으로 설정됩니다. configurationItemDiff.changeType이 'CREATE'인 경우 metadata.event_type은 'RESOURCE_CREATION'으로 설정됩니다. configurationItem.configurationItemStatus가 'OK' 또는 'ResourceDiscovered'인 경우 metadata.event_type이 'RESOURCE_READ'로 설정됩니다. configurationItem.configurationItemStatus이 'ResourceDeleted'인 경우 metadata.event_type이 'RESOURCE_DELETION'으로 설정됩니다. 이러한 조건이 충족되지 않으면 metadata.event_type이 'GENERIC_EVENT'로 설정됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis guide explains how to collect AWS Config logs for analysis within Google SecOps, including the creation of an S3 bucket and an IAM user to facilitate log retrieval.\u003c/p\u003e\n"],["\u003cp\u003eAWS Config provides a detailed overview of the configuration, relationships, and historical changes of AWS resources within a user's AWS account.\u003c/p\u003e\n"],["\u003cp\u003eThe configuration involves creating a CloudTrail trail and an S3 bucket to store the logs, and setting up AWS Config to log API calls and applying optional compliance rules.\u003c/p\u003e\n"],["\u003cp\u003eAn IAM user with read access to the S3 bucket must be set up, or full access if Google SecOps will be clearing the buckets, to allow Google SecOps to retrieve logs.\u003c/p\u003e\n"],["\u003cp\u003eThe process concludes with creating and configuring a feed in Google SecOps to ingest AWS Config logs from the designated S3 bucket using the provided IAM user credentials.\u003c/p\u003e\n"]]],[],null,["# Collect AWS Config logs\n=======================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to create a new S3 bucket to store the CloudTrail logs and how to create an IAM user to retrieve the log feeds from AWS.\nAWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so that you can see how the configurations and relationships change over time.\n\nBefore you begin\n----------------\n\nEnsure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nConfigure CloudTrail and AWS S3 bucket\n--------------------------------------\n\n1. Sign in to the AWS Management Console.\n2. Go to the [Amazon S3 console](https://console.aws.amazon.com/s3/).\n3. In the AWS console, search for **Cloudtrail**.\n4. Click **Create trail**.\n5. Provide a **Trail name**.\n6. Select **Create new S3 bucket** (you may also choose to use an existing S3 bucket).\n7. Provide a name for the **AWS KMS** alias, or choose an existing AWS KMS Key.\n\n | **Note:** Leave the other settings as default.\n8. Click **Next**.\n\n9. Choose **Event type** and add **Data events**.\n\n10. Click **Next**.\n\n11. Review the settings and click **Create trail**.\n\n12. In the AWS console, search for **S3 Buckets**.\n\n13. Click the newly created log bucket, and select the **AWSLogs** folder.\n\n14. Click **Copy S3 URI** and save it.\n\nConfigure AWS Config API Calls Logging\n--------------------------------------\n\n1. In AWS, go to **AWS Config \\\u003e Set up AWS Config**.\n2. Select the bucket type (either select the existing bucket details or create a new one).\n3. Select all required AWS-managed rules and click **Next** to select a bucket.\n4. Refer to [AWS Config](https://docs.aws.amazon.com/pdfs/config/latest/developerguide/config-dg.pdf) for details on rule types to help you select the appropriate rule based on your requirements:\n - **Compliance rules**: allow to evaluate the configurations of resources to ensure that they meet compliance standards or regulatory requirements.\n - **Configuration rules**: allow to evaluate the configurations of resources to ensure that they meet the required configuration standards.\n - **Performance rules**: allow to evaluate the configurations of resources to ensure that they are optimized for performance.\n - **Security rules**: allow to evaluate the configurations of resources to ensure that they meet security standards or requirements.\n5. Click **Create config**.\n6. Go to [Amazon S3](https://console.aws.amazon.com/s3/).\n7. Click the newly created log bucket, and select the folder **AWSLogs**.\n8. Click **Copy S3 URI** and save it.\n\nConfigure AWS IAM User\n----------------------\n\n1. In the AWS console, search for **IAM**.\n2. Click **Users**.\n3. Click **Add Users**.\n4. Provide a name for the user (for example, chronicle-feed-user).\n5. Select **Access key - Programmatic access** as the AWS credential type.\n6. Click **Next: Permissions**.\n7. Select **Attach existing policies directly**.\n8. Select **AmazonS3ReadOnlyAccess** or **AmazonS3FullAccess**.\n\n| **Note:** Use **AmazonS3FullAccess** if Google SecOps needs to clear the S3 buckets after reading logs to optimize AWS S3 storage costs.\n\n1. Click **Next: Tags**.\n2. Optional: Add any tags if required.\n3. Click **Next: Review**.\n4. Review the configuration and click **Create user**.\n5. Copy the Access key ID and Secret access key of the created user.\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the AWS Config feed\n---------------------------------\n\n1. Click the **Amazon Cloud Platform** pack.\n2. Locate the **AWS Config** log type.\n3. Specify the values in the following fields.\n\n - **Source Type**: Amazon SQS V2\n - **Queue Name**: The SQS queue name to read from\n - **S3 URI** : The bucket URI.\n - `s3://your-log-bucket-name/`\n - Replace `your-log-bucket-name` with the actual name of your S3 bucket.\n - **Source deletion options**: Select the deletion option according to your ingestion preferences.\n\n | **Note:** If you select the `Delete transferred files` or `Delete transferred files and empty directories` option, make sure that you granted appropriate permissions to the service account.\n - **Maximum File Age**: Include files modified in the last number of days. Default is 180 days.\n\n - **SQS Queue Access Key ID**: An account access key that is a 20-character alphanumeric string.\n\n - **SQS Queue Secret Access Key**: An account access key that is a 40-character alphanumeric string.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace**: Namespace associated with the feed.\n - **Ingestion Labels**: Labels applied to all events from this feed.\n4. Click **Create feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\nUDM Mapping\n-----------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
