이 문서에서는 CloudWatch Logs 및 Kinesis Data Firehose를 사용하여 AWS VPC 트랜짓 게이트웨이 흐름 로그를 Google Security Operations에 수집하는 방법을 설명합니다. 전송 게이트웨이 흐름 로그는 전송 게이트웨이 연결 전반에서 자세한 네트워크 트래픽 메타데이터를 캡처합니다. 이 통합은 모니터링 및 보안 분석을 위해 이러한 로그를 Google SecOps로 스트리밍합니다.
시작하기 전에
다음 기본 요건이 충족되었는지 확인합니다.
Google SecOps 인스턴스
AWS에 대한 액세스 권한
전송 게이트웨이 흐름 로그 (CloudWatch 로그) 사용 설정
AWS 콘솔에 로그인합니다.
VPC > 전송 게이트웨이 (또는 전송 게이트웨이 연결)로 이동합니다.
타겟 리소스를 선택합니다.
작업 > 흐름 로그 만들기를 클릭합니다.
다음 구성 세부정보를 제공합니다.
대상: CloudWatch Logs로 전송을 선택합니다.
로그 그룹: 로그 그룹 (예: /aws/tgw/flowlogs)을 선택하거나 만듭니다.
IAM 역할: CloudWatch Logs에 쓸 수 있는 역할을 선택합니다.
최대 집계 간격: 1분 (권장) 또는 10분을 선택합니다.
로그 레코드 형식: 기본값을 선택합니다 (추가 필드가 필요한 경우 맞춤).
흐름 로그 만들기를 클릭합니다.
전송 게이트웨이 흐름 로그를 수집하도록 Google SecOps에서 피드 구성
SIEM 설정> 피드로 이동합니다.
+ 새 피드 추가를 클릭합니다.
피드 이름 필드에 AWS Transit Gateway Flow Logs — CloudWatch via Firehose를 입력합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-10(UTC)"],[],[],null,["Collect AWS VPC Transit Gateway flow logs \nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis document explains how to ingest AWS VPC Transit Gateway flow logs to Google Security Operations using CloudWatch Logs and Kinesis Data Firehose. Transit Gateway flow logs capture detailed network traffic metadata across your Transit Gateway attachments. This integration streams these logs into Google SecOps for monitoring and security analytics.\n\nBefore you begin\n\nMake sure you have the following prerequisites:\n\n- Google SecOps instance\n- Privileged access to AWS\n\nEnable Transit Gateway flow logs (to CloudWatch logs)\n\n1. Sign in to the **AWS Console**\n2. Go to **VPC \\\u003e Transit gateways** (or **Transit gateway attachments**).\n3. Select the target resource(s).\n4. Click **Actions \\\u003e Create flow log**.\n5. Provide the following configuration details:\n - **Destination** : Select **Send to CloudWatch Logs**.\n - **Log group** : Choose or create a log group (for example, `/aws/tgw/flowlogs`).\n - **IAM role**: Select a role that can write to CloudWatch Logs.\n - **Maximum aggregation interval** : Choose **1 minute** (recommended) or **10 minutes**.\n - **Log record format** : Select **Default** (or **Custom** if you need additional fields).\n6. Click **Create flow log**.\n\nConfigure a Feed in Google SecOps to Ingest Transit Gateway Flow Logs\n\n1. Go to **SIEM Settings \\\u003e Feeds**.\n2. Click **+ Add New Feed**.\n3. In the **Feed name** field, enter `AWS Transit Gateway Flow Logs --- CloudWatch via Firehose`.\n4. Select **Amazon Data Firehose** as the **Source type**.\n5. Select **Amazon VPC Transit Gateway Flow Logs** as the **Log type**.\n6. Click **Next**.\n7. Specify values for the following input parameters:\n - **Split delimiter** : Optional `n`.\n - **Asset namespace** : the [asset namespace](/chronicle/docs/investigation/asset-namespaces).\n - **Ingestion labels**: the label applied to the events from this feed.\n8. Click **Next \\\u003e Submit**.\n9. In the feed **Details** , click **Generate Secret Key** and copy the **Secret Key**.\n10. Copy the **Feed HTTPS endpoint URL** from **Endpoint Information**.\n11. In **Google Cloud console \\\u003e APIs \\& Services \\\u003e Credentials \\\u003e Create credentials \\\u003e API key** , create an **API key** and **restrict it to Chronicle API** . Copy the **API key**.\n\nConfigure Amazon Kinesis Data Firehose (Direct to Google SecOps)\n\n1. In the **AWS Console** , go to **Kinesis \\\u003e Data Firehose \\\u003e Create delivery stream**.\n2. Provide the following configuration details:\n - **Source** : Select **Direct PUT or other sources**.\n - **Destination** : Choose **HTTP endpoint**.\n - **HTTP endpoint URL** : Enter `ENDPOINT_URL?key=API_KEY` (use the Feed HTTPS endpoint URL and the API key from the previous step).\n - **HTTP method** : Select **POST**.\n - **Access key**: Paste the Secret Key generated in the feed.\n - **Buffering hints** : Set **Buffer size** = **1 MiB** , **Buffer interval** = **60 seconds**.\n - **Compression** : Select **Disabled**.\n - **S3 backup** : Select **Disabled**.\n - Leave **retry** and **logging** settings as default.\n3. Click **Create delivery stream** . (Example name: `cwlogs-to-secops`)\n\nConfigure IAM Permissions and Subscribe the Log Group\n\n1. In the **AWS console** , go to **IAM \\\u003e Policies \\\u003e Create policy \\\u003e JSON tab**.\n2. Enter the following policy:\n\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"firehose:PutRecord\",\n \"firehose:PutRecordBatch\"\n ],\n \"Resource\": \"arn:aws:firehose:\u003cregion\u003e:\u003caccount-id\u003e:deliverystream/cwlogs-to-secops\"\n }\n ]\n }\n\n - Replace `\u003cregion\u003e` and `\u003caccount-id\u003e` with your AWS Region and account ID.\n3. Name the policy `CWLtoFirehoseWrite` and click **Create policy**.\n\n4. Go to **IAM \\\u003e Roles**.\n\n5. Click **Create role**.\n\n6. Select **Custom trust policy** and enter the following:\n\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Principal\": {\n \"Service\": \"logs.\u003cyour-region\u003e.amazonaws.com\"\n },\n \"Action\": \"sts:AssumeRole\"\n }\n ]\n }\n\n7. Attach the policy `CWLtoFirehoseWrite` to the role.\n\n8. Name the role `CWLtoFirehoseRole` and click **Create role**.\n\n9. Go to **CloudWatch \\\u003e Logs \\\u003e Log groups**.\n\n10. Select the Transit Gateway **log group** you enabled earlier.\n\n11. Open the **Subscription filters** tab and click **Create**.\n\n12. Choose **Create Amazon Kinesis Data Firehose subscription filter**.\n\n13. Configure the following:\n\n - **Destination** : Delivery stream `cwlogs-to-secops`.\n - **Grant permission** : Role `CWLtoFirehoseRole`.\n - **Filter name** : Enter `all-events`.\n - **Filter pattern**: Leave empty to send all events.\n14. Click **Start streaming**.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
