Configuring CloudTrail Logs for EC2 Events

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab walks you through the steps to configure CloudTrail to be able to access your log files.
2. You will practice using AWS CloudTrail, Amazon S3 and Amazon EC2.
3. Duration: 45 minutes
4. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

​

What is Cloud Trail ?

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your Amazon Web Services account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the Amazon Management Console, Amazon SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting. Here are some of the benefits of using CloudTrail:

• Improved security: CloudTrail can help you identify and respond to unauthorized or malicious activity in your AWS account.
• Increased compliance: CloudTrail can help you demonstrate compliance with industry regulations, such as PCI DSS, HIPAA, and SOX.
• Simplified auditing: CloudTrail can help you simplify your auditing process by providing a centralized repository of audit logs.
• Better troubleshooting: CloudTrail can help you troubleshoot problems in your AWS environment by providing a historical record of events.

​

Architecture diagram

​

Task details

1. Sign into the AWS management Console
2. Configuring CloudTrail and S3 Bucket.
3. Checking the S3 Bucket .
4. Viewing the logs in the S3 Bucket
5. Launching an EC2 Instance
6. Checking Log files created by EC2
7. Connecting to EC2 instance
8. Access log files in S3 created for the events.
9. Validation of the lab.

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,

• Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
• Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button

3. Once Signed in to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.

​

Task 2: Configuring CloudTrail and an S3 Bucket

1. Navigate and click on CloudTrail, which will be available under the Management and Governance section of Services.
2. Click on menu icon on the top-left corner and click on Trails. Now click on Create trail
3. Under Create Trail, enter these details:

• Trail name : Enter My_First_Trail
• Storage Location : Select Create a new S3 Bucket
  • Trail log bucket and folder : Leave it as default
• Log file SSE-KMS encryption : Uncheck Enabled
• Additional Settings:
  • Log file validation : Uncheck Enabled
  • SNS notification delivery : Leave it as default
• CloudWatch Logs : Leave it as default
• Tags- optional:
  • Key: Enter Name
  • Value: Enter my_logs
• Click on Next.
• Choose Log Events:
  • Leave everything as default and click on Next.
• Review and click on Create trail.

4. A CloudTrail instance that delivers logs to an S3 bucket has now been created.

​

Task 3: Checking the S3 Bucket

1. Navigate to Services. Under Storage, click and open S3 in a new tab.
2. Under S3 Buckets, you can see the bucket which was created by CloudTrail.

​

Task 4: Viewing the Logs in the S3 Bucket

1. AWS CloudTrail captures AWS API calls and related events made by or on behalf of an AWS account and delivers log files to a specified S3 bucket. CloudTrail typically delivers log files within 15 minutes of an API call and publishes new log files multiple times an hour, usually about every 5 minutes.
2. Wait for a few minutes until the first log is created.
3. Keep refreshing the page and then open the bucket once logs appear.
4. Click and open the folders inside the bucket in the below order:
   • bucket name -> AWS Logs -> Account No. -> CloudTrails -> us-east-1 -> Year No. -> Month No. -> Day No.
5. You can see the logs are being created inside the bucket.
6. Click on the file and choose Open.
7. You will see a JSON file content. To format the content, we will use a JSON formatter. Copy the content.
8. Click JSONFormatter and paste the file content in the user input field. Click on Format/Beautify to format the JSON blob.
9. You will see the Username, EventTime, EventSource, EventName, etc. You can see all the details about the particular event that happened.

​

Task 5: Launching an EC2 Instance

1. Make sure you are in US East(N.Virginia) Region.
2. Navigate to the Services menu at the top, then click on EC2 in the Compute section.
3. Navigate to Instances on the left panel and click on Launch Instances
4. Name: enter whizlabs-instance.
5. Choose an Amazon Machine Image (AMI): Select Amazon Linux 2023 AMI in the drop-down.

6. Choose an Instance Type: Select t2.micro**.**
7. Key Pair: Select Proceed without a Key Pair

8. On the right side under the Summary section ,

• Number of Instances: 1

9. Click on the Launch Instances.
10. Launch Status: Your instance is now launching, Click on the instance ID and wait for complete initialization of instance (until the status changes to running).

​

Task 6: Checking Log files created by the EC2 Instance

1. Navigate back to S3 and go to the latest log file (as mentioned above).
2. Wait for 5-10 minutes if the new log has not been created yet.
3. Click on the log, open the file and copy the content and format it with JSONFormatter.
4. You will see the eventName of all the resources created like Securitygroups, VPC, etc. while launching the EC2 Instances.

​

Task 7: Connecting to the EC2 Instance

1. Navigate to EC2.
2. Select your EC2 Instance and click on Connect.
3. Select EC2 Instance Connect (browser-based SSH connection) and click on Connect.
4. Since this is for demo purposes, we can close the window after verifying a connection to the instance.

​

Task 8: Checking for a log file after connecting to the EC2 Instance

1. Navigate back to S3 and go to Logs (as mentioned above).
2. Click on the latest log created and open it.
3. Copy the file content to the JSON Formatter and format the JSON blob.
4. You can see the eventTime, eventSource, eventName, and the rest of the fields in the JSON blob.

​

Task 9: Validation Test

1. Once the lab steps are completed, please click on the Check my work button on the right side panel.
2. This will validate the resources in the AWS account and displays whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully used the AWS management console to create an AWS CloudTrail.
2. You have successfully created an Amazon S3 Bucket.
3. You have formatted the new Log file and confirmed the events inside the JSON blob.
4. You have launched an EC2 Instance and connected to it via browser.
5. You have tested the log file from the. EC2 creation and the log file from connecting to the instance via SSH.

​

End lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Check Cloudtrail logs — Check whether cloudtrail log is created or not
• Launch an EC2 Instance — Check whether an EC2 Instance is launched or not.

​

Related help

• FAQs and Troubleshooting