Logging & Monitoring Configurations

Native AWS logging configurations and services that you can leverage to provide greater visibility near to real time for occurrences in the AWS environment. Currently this includes AWS CloudTrail and AWS Config.

How-to guide for implementing a comprehensive Logging & Monitoring Strategy

A configuration package to enable AWS security logging and activity monitoring services: AWS CloudTrail, AWS Config, and Amazon GuardDuty. The package also includes an S3 bucket to store CloudTrail and Config history logs, as well as an optional CloudWatch log group to receive CloudTrail logs.

Configuration to enable AWS CloudTrail in an AWS account with optional settings such as Log Encryption, Log File Validation and Log forwarding to CloudWatch logs. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

Configuration to enable AWS CloudTrail including configuration to stream CloudTrail events to CloudWatch Logs. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

Configuration to enable AWS Config. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Configuration to create a CloudWatch Log Group with option for defining a log retention period.

Flow Logs enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow Logs can be enabled on a VPC, subnet, or network interface level.

Configuration to enable Traffic Mirroring from a network interface (ENI) of an Amazon EC2 instance, which can then be used for monitoring and security analysis. Traffic Mirroring supports filters and packet truncation so that only traffic of interest is monitored.