Log files Should Be Delivered Without Any Failures

Using Console

To remediate the misconfiguration “Log files should be delivered without any failures” for AWS using AWS console, follow the below steps:

Open the AWS Management Console and navigate to the CloudWatch service.
Click on “Logs” in the left-hand menu and select the log group that is experiencing the delivery failure.
Click on the “Actions” drop-down menu and select “Stream to Amazon Elasticsearch Service”.
In the “Stream to Amazon Elasticsearch Service” dialog box, select the Elasticsearch domain that you want to stream the log data to.
Choose the appropriate IAM role that has permission to stream the log data to the Elasticsearch domain.
Configure the log stream settings as required and click on “Start Streaming”.
Once the log stream is successfully started, CloudWatch will begin delivering log data to the Elasticsearch domain without any failures.
You can monitor the log stream status and troubleshoot any issues using the CloudWatch Logs console.

By following these steps, you can remediate the misconfiguration “Log files should be delivered without any failures” for AWS using AWS console.

Using CLI

To remediate the misconfiguration “Log files Should Be Delivered Without Any Failures” in AWS, you can follow the below steps using AWS CLI:

Open the AWS CLI on your local machine or terminal.
Run the following command to create a new S3 bucket to store the logs:
aws s3api create-bucket --bucket <bucket-name> --region <region> --create-bucket-configuration LocationConstraint=<region>
Replace <bucket-name> with your desired bucket name and <region> with the region in which you want to create the bucket.

Run the following command to enable access logging for your S3 bucket:

aws s3api put-bucket-acl --bucket <bucket-name> --grant-read uri=http://acs.amazonaws.com/groups/s3/LogDelivery --grant-write uri=http://acs.amazonaws.com/groups/s3/LogDelivery --grant-read-acp uri=http://acs.amazonaws.com/groups/s3/LogDelivery --grant-write-acp uri=http://acs.amazonaws.com/groups/s3/LogDelivery --grant-full-control uri=http://acs.amazonaws.com/groups/s3/LogDelivery

Replace <bucket-name> with the name of the bucket you created in step 2.

Run the following command to create a new CloudWatch Logs group:
aws logs create-log-group --log-group-name <log-group-name>
Replace <log-group-name> with your desired name for the log group.
Run the following command to create a new CloudWatch Logs stream:
aws logs create-log-stream --log-group-name <log-group-name> --log-stream-name <log-stream-name>
Replace <log-group-name> with the name of the log group you created in step 4 and <log-stream-name> with your desired name for the log stream.
Run the following command to create a new CloudWatch Logs subscription filter:
aws logs put-subscription-filter --log-group-name <log-group-name> --filter-name <filter-name> --filter-pattern "" --destination-arn arn:aws:s3:::<bucket-name>
Replace <log-group-name> with the name of the log group you created in step 4, <filter-name> with your desired name for the filter, and <bucket-name> with the name of the S3 bucket you created in step 2.
Verify that the logs are being delivered to the S3 bucket by checking the contents of the bucket. You should see log files being created and updated in real-time.

By following these steps, you can remediate the misconfiguration “Log files Should Be Delivered Without Any Failures” in AWS using AWS CLI.

Using Python

To remediate the misconfiguration “Log files Should Be Delivered Without Any Failures” for AWS using Python, you can follow these steps:Step 1: Create an S3 bucket to store the log files.

import boto3

s3 = boto3.client('s3')

bucket_name = 'your-bucket-name'

s3.create_bucket(Bucket=bucket_name)

Step 2: Create an IAM role with permissions to write to the S3 bucket.

import boto3

iam = boto3.client('iam')

role_name = 'your-role-name'

assume_role_policy_document = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "logs.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

response = iam.create_role(
    RoleName=role_name,
    AssumeRolePolicyDocument=json.dumps(assume_role_policy_document)
)

policy_document = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::your-bucket-name/*"
            ]
        }
    ]
}

iam.put_role_policy(
    RoleName=role_name,
    PolicyName='your-policy-name',
    PolicyDocument=json.dumps(policy_document)
)

Step 3: Create a CloudWatch Logs subscription filter to deliver the log files to the S3 bucket.

import boto3

logs = boto3.client('logs')

log_group_name = 'your-log-group-name'
filter_name = 'your-filter-name'
destination_arn = 'arn:aws:s3:::your-bucket-name'

response = logs.put_subscription_filter(
    logGroupName=log_group_name,
    filterName=filter_name,
    filterPattern='',
    destinationArn=destination_arn,
    roleArn='arn:aws:iam::your-account-id:role/your-role-name'
)

Note: Replace the placeholders (your-bucket-name, your-role-name, your-policy-name, your-log-group-name, your-filter-name, and your-account-id) with your own values.These steps will remediate the misconfiguration “Log files Should Be Delivered Without Any Failures” for AWS using Python.

Using Terraform

# S3 bucket policy allowing CloudTrail to deliver logs
resource "aws_s3_bucket_policy" "cloudtrail_logs" {
  bucket = aws_s3_bucket.cloudtrail_logs_bucket.id  # replace with your bucket

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AWSCloudTrailAclCheck"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "s3:GetBucketAcl"
        Resource = "arn:aws:s3:::${aws_s3_bucket.cloudtrail_logs_bucket.bucket}"
      },
      {
        Sid    = "AWSCloudTrailWrite"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "s3:PutObject"
        Resource = "arn:aws:s3:::${aws_s3_bucket.cloudtrail_logs_bucket.bucket}/AWSLogs/${data.aws_caller_identity.current.account_id}/*"
        Condition = {
          StringEquals = {
            "s3:x-amz-acl" = "bucket-owner-full-control"
          }
        }
      }
    ]
  })
}

# Example bucket used above
resource "aws_s3_bucket" "cloudtrail_logs_bucket" {
  bucket = "CLOUDTRAIL_LOGS_BUCKET_NAME" # replace with your CloudTrail S3 bucket name
}

data "aws_caller_identity" "current" {}

# KMS key policy allowing CloudTrail to encrypt logs (only if your trail uses SSE-KMS)
resource "aws_kms_key" "cloudtrail_logs_key" {
  description             = "KMS key for CloudTrail log encryption"
  deletion_window_in_days = 30

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "Enable IAM User Permissions"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      },
      {
        Sid    = "Allow CloudTrail to encrypt logs"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action = [
          "kms:GenerateDataKey*",
          "kms:DescribeKey",
        ]
        Resource = "*"
      }
    ]
  })
}

# Attach this KMS key to your CloudTrail trail (no replacement of the trail)
resource "aws_cloudtrail" "trail" {
  name                          = "CLOUDTRAIL_TRAIL_NAME"          # replace
  s3_bucket_name                = aws_s3_bucket.cloudtrail_logs_bucket.bucket
  kms_key_id                    = aws_kms_key.cloudtrail_logs_key.arn
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true

  cloud_watch_logs_group_arn  = aws_cloudwatch_log_group.cloudtrail_logs.arn
  cloud_watch_logs_role_arn   = aws_iam_role.cloudtrail_to_cw.arn
}

# CloudWatch Logs log group for the trail (only if using CloudWatch Logs)
resource "aws_cloudwatch_log_group" "cloudtrail_logs" {
  name              = "CLOUDTRAIL_LOG_GROUP_NAME" # replace
  retention_in_days = 90
}

# CloudWatch Logs resource policy allowing CloudTrail to create streams and put events
resource "aws_cloudwatch_log_resource_policy" "cloudtrail_delivery" {
  policy_name = "CloudTrail-Delivery-Policy-${aws_cloudtrail.trail.name}"

  # WARNING: This resource creates or overwrites a CloudWatch Logs resource policy
  policy_document = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AWSCloudTrailCreateLogStream"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "logs:CreateLogStream"
        Resource = aws_cloudwatch_log_group.cloudtrail_logs.arn
      },
      {
        Sid    = "AWSCloudTrailPutLogEvents"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action   = "logs:PutLogEvents"
        Resource = aws_cloudwatch_log_group.cloudtrail_logs.arn
      }
    ]
  })
}

# IAM role CloudTrail uses to write to CloudWatch Logs (already required by CloudTrail)
resource "aws_iam_role" "cloudtrail_to_cw" {
  name = "CLOUDTRAIL_CW_ROLE_NAME" # replace

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy" "cloudtrail_to_cw_policy" {
  role = aws_iam_role.cloudtrail_to_cw.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = ["logs:CreateLogStream", "logs:PutLogEvents"]
        Resource = aws_cloudwatch_log_group.cloudtrail_logs.arn
      }
    ]
  })
}

None of these changes force replacement of the S3 bucket, KMS key, CloudTrail trail, or CloudWatch Logs log group; they update policies in place, though the aws_cloudwatch_log_resource_policy will overwrite any existing CloudWatch Logs resource policy with the same policy_name.After applying, terraform plan should show:

creation or in-place update of aws_s3_bucket_policy.cloudtrail_logs with the two CloudTrail statements,
the KMS key (or only its policy change if it already exists) containing the CloudTrail statement,
creation or update of aws_cloudwatch_log_resource_policy.cloudtrail_delivery with the two CloudTrail statements, and no planned resource replacements.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Log files Should Be Delivered Without Any Failures

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: