01 Run create-log-group command (OSX/Linux/UNIX) to create a new Amazon CloudWatch Logs log group within the selected AWS region (the command does not produce an output):
aws logs create-log-group
--region us-east-1
--log-group-name /aws/OpenSearchService/domains/trendmicro
02 Run describe-log-groups command (OSX/Linux/UNIX) to describe the Amazon Resource Name (ARN) of the log group created at the previous step:
aws logs describe-log-groups
--region us-east-1
--log-group-name /aws/OpenSearchService/domains/trendmicro
--query 'logGroups[*].arn'
03 The command output should return the requested log group ARN:
[
"arn:aws:logs:us-east-1:123456789012:log-group:/aws/OpenSearchService/domains/trendmicro:*",
]
04 Run put-resource-policy command (OSX/Linux/UNIX) to give the Amazon OpenSearch service the permissions to write to the newly created log group:
aws logs put-resource-policy
--region us-east-1
--policy-name cc-audit-logs-policy
--policy-document '{ "Version": "2012-10-17", "Statement": [{ "Sid": "", "Effect": "Allow", "Principal": { "Service": "es.amazonaws.com"}, "Action":[ "logs:PutLogEvents","logs:CreateLogStream"],"Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/OpenSearchService/domains/trendmicro:*"}]}'
05 The command output should return the implemented access policy (JSON format):
{
"resourcePolicy": {
"policyName": "cc-elasticsearch-audit-logs-policy",
"policyDocument": "{ \"Version\": \"2012-10-17\", \"Statement\": [{ \"Sid\": \"\", \"Effect\": \"Allow\", \"Principal\": { \"Service\": \"es.amazonaws.com\"}, \"Action\":[ \"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\": \"arn:aws:logs:us-east-1:123456789012:log-group:/aws/OpenSearchService/domains/trendmicro:*\"}]}",
"lastUpdatedTime": 1601657014344
}
}
06 Run update-elasticsearch-domain-config command (OSX/Linux/UNIX) to enable and configure audit logs for the selected Amazon OpenSearch cluster:
aws es update-elasticsearch-domain-config
--region us-east-1
--domain-name trendmicro
--log-publishing-options "AUDIT_LOGS={CloudWatchLogsLogGroupArn=arn:aws:logs:us-east-1:123456789012:log-group:/aws/OpenSearchService/domains/trendmicro:*,Enabled=true}"
07 The command output should return the new configuration information available for the modified OpenSearch cluster:
{
"DomainConfig": {
"ElasticsearchClusterConfig": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"WarmEnabled": false,
"DedicatedMasterEnabled": false,
"InstanceCount": 1,
"ZoneAwarenessEnabled": false,
"InstanceType": "t3.small.elasticsearch"
}
},
"VPCOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641218607.34,
"UpdateVersion": 21,
"UpdateDate": 1641218607.34
},
"Options": {}
},
"CognitoOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641218607.34,
"UpdateVersion": 21,
"UpdateDate": 1641218607.34
},
"Options": {
"Enabled": false
}
},
"NodeToNodeEncryptionOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"Enabled": false
}
},
"AdvancedSecurityOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"InternalUserDatabaseEnabled": false,
"Enabled": false
}
},
"DomainEndpointOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"EnforceHTTPS": false,
"TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07"
}
},
"EBSOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"VolumeSize": 30,
"VolumeType": "gp2",
"EBSEnabled": true
}
},
"SnapshotOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"AutomatedSnapshotStartHour": 0
}
},
"ElasticsearchVersion": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": "7.9"
},
"LogPublishingOptions": {
"Status": {
"PendingDeletion": false,
"State": "Processing",
"CreationDate": 1641216346.828,
"UpdateVersion": 21,
"UpdateDate": 1641218607.199
},
"Options": {
"AUDIT_LOGS": {
"CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/OpenSearchService/domains/trendmicro:*",
"Enabled": true
}
}
},
"AdvancedOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"override_main_response_version": "false",
"rest.action.multi.allow_explicit_index": "false",
"indices.fielddata.cache.size": ""
}
},
"EncryptionAtRestOptions": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": {
"Enabled": false
}
},
"AccessPolicies": {
"Status": {
"PendingDeletion": false,
"State": "Active",
"CreationDate": 1641212317.965,
"UpdateVersion": 5,
"UpdateDate": 1641213076.849
},
"Options": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":{\"AWS\":\"*\"},\"Action\":\"es:*\",\"Resource\":\"arn:aws:es:us-east-1:123456789012:domain/trendmicro/*\"}]}"
}
}
}
08 Repeat steps no. 6 and 7 to enable the Audit Logs feature for other Amazon OpenSearch clusters available in the selected AWS region.
09 Change the AWS cloud region by updating the --region command parameter value and repeat the Remediation process for other regions.
Security