AWS AWSCloudFormation medium security documentation change
Summary
Updated CloudWatch Logs template to use Amazon Linux 2023, replaced yum with dnf, simplified IAM permissions (removed s3:GetObject), migrated to unified CloudWatch agent, and improved security configurations.
Security assessment
Removed s3:GetObject permission which was previously required for downloading agents from S3, reducing attack surface. Updated IAM policy to least-privilege logs permissions instead of wildcard Create* actions. SecurityGroupIds reference and retained policies improve resource protection.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/quickref-cloudwatchlogs.md b/AWSCloudFormation/latest/UserGuide/quickref-cloudwatchlogs.md index 4398eafff..0fc43519e 100644 --- a//AWSCloudFormation/latest/UserGuide/quickref-cloudwatchlogs.md +++ b//AWSCloudFormation/latest/UserGuide/quickref-cloudwatchlogs.md @@ -24 +24 @@ Amazon CloudWatch Logs can monitor your system, application, and custom log file -The following template describes a web server and its custom metrics. Log events from the web server's log provides the data for the custom metrics. To send log events to a custom metric, the `UserData` field installs a CloudWatch Logs agent on the Amazon EC2 instance. The configuration information for the agent, such as the location of the server log file, the log group name, and the log stream name, are defined in the `/tmp/cwlogs/apacheaccess.conf` file. The log stream is created after the web server starts sending log events to the `/var/log/httpd/access_log` file. +The following template demonstrates how to set up a web server on Amazon Linux 2023 with CloudWatch Logs integration. The template performs the following tasks: @@ -26 +26 @@ The following template describes a web server and its custom metrics. Log events -###### Note + * Installs Apache and PHP. @@ -28 +28 @@ The following template describes a web server and its custom metrics. Log events -A note about permissions: The `WebServerHost` instance references the `LogRoleInstanceProfile` instance profile, which in turn references the `LogRole` role. `LogRole` specifies the `s3:GetObject` permission for _arn:aws:s3:::*_. + * Configures the CloudWatch agent to forward Apache access logs to CloudWatch Logs. @@ -30 +30 @@ A note about permissions: The `WebServerHost` instance references the `LogRoleIn -This permission is required because `WebServerHost` downloads the CloudWatch Logs agent (`awslogs-agent-setup.py`) from Amazon S3 in the `UserData` section. + * Sets up an IAM role to allow the CloudWatch agent to send log data to CloudWatch Logs. @@ -32 +32,6 @@ This permission is required because `WebServerHost` downloads the CloudWatch Log -The two metric filters describe how the log information is transformed into CloudWatch metrics. The 404 metric counts the number of 404 occurrences. The size metric tracks the size of a request. The two CloudWatch alarms will send notifications if there are more than two 404s within 2 minutes or if the average request size is over 3500 KB over 10 minutes. + * Creates custom alarms and notifications to monitor for 404 errors or high bandwidth usage. + + + + +Log events from the web server provide metric data for CloudWatch alarms. The two metric filters describe how the log information is transformed into CloudWatch metrics. The 404 metric counts the number of 404 occurrences. The size metric tracks the size of a request. The two CloudWatch alarms will send notifications if there are more than two 404s within 2 minutes or if the average request size is over 3500 KB over 10 minutes. @@ -39 +44 @@ The two metric filters describe how the log information is transformed into Clou - "Description": "AWS CloudFormation Sample Template for CloudWatch Logs.", + "Description": "Sample template that sets up and configures CloudWatch Logs on Amazon Linux 2023 instance.", @@ -56 +61 @@ The two metric filters describe how the log information is transformed into Clou - "Description": "Email address to notify if there are any scaling operations", + "Description": "Email address to notify when CloudWatch alarms are triggered (404 errors or high bandwidth usage)", @@ -60,31 +64,0 @@ The two metric filters describe how the log information is transformed into Clou - "Mappings": { - "RegionMap": { - "us-east-1": { - "AMI": "ami-0ff8a91507f77f867" - }, - "us-west-1": { - "AMI": "ami-0bdb828fd58c52235" - }, - "us-west-2": { - "AMI": "ami-a0cfeed8" - }, - "eu-west-1": { - "AMI": "ami-047bb4163c506cd98" - }, - "ap-southeast-1": { - "AMI": "ami-08569b978cc4dfa10" - }, - "ap-southeast-2": { - "AMI": "ami-09b42976632b27e9b" - }, - "ap-northeast-1": { - "AMI": "ami-06cd52961ce9f0d85" - }, - "sa-east-1": { - "AMI": "ami-07b14488da8ea02a0" - }, - "eu-central-1": { - "AMI": "ami-0233214e13e500f77" - } - } - }, @@ -121 +94,0 @@ The two metric filters describe how the log information is transformed into Clou - "logs:Create*", @@ -123 +96,4 @@ The two metric filters describe how the log information is transformed into Clou - "s3:GetObject" + "logs:DescribeLogStreams", + "logs:DescribeLogGroups", + "logs:CreateLogGroup", + "logs:CreateLogStream" @@ -125,4 +101 @@ The two metric filters describe how the log information is transformed into Clou - "Resource": [ - "arn:aws:logs:*:*:*", - "arn:aws:s3:::*" - ] + "Resource": "*" @@ -140,5 +113 @@ The two metric filters describe how the log information is transformed into Clou - "Roles": [ - { - "Ref": "LogRole" - } - ] + "Roles": [{"Ref": "LogRole"}] @@ -162,3 +131 @@ The two metric filters describe how the log information is transformed into Clou - "CidrIp": { - "Ref": "SSHLocation" - } + "CidrIp": {"Ref": "SSHLocation"} @@ -172 +139 @@ The two metric filters describe how the log information is transformed into Clou - "Comment": "Install a simple PHP application", + "Comment": "Install a simple PHP application on Amazon Linux 2023", @@ -176 +143 @@ The two metric filters describe how the log information is transformed into Clou - "yum": { + "dnf": { @@ -178 +145,2 @@ The two metric filters describe how the log information is transformed into Clou - "php": [] + "php": [], + "php-fpm": [] @@ -182 +150 @@ The two metric filters describe how the log information is transformed into Clou - "/tmp/cwlogs/apacheaccess.conf": { + "/etc/amazon-cloudwatch-agent/amazon-cloudwatch-agent.json": { @@ -184,16 +152,12 @@ The two metric filters describe how the log information is transformed into Clou - "Fn::Join": [ - "", - [ - "[general]\n", - "state_file= /var/awslogs/agent-state\n", - "[/var/log/httpd/access_log]\n", - "file = /var/log/httpd/access_log\n", - "log_group_name = ", - { - "Ref": "WebServerLogGroup" - }, - "\n", - "log_stream_name = {instance_id}/apache.log\n", - "datetime_format = %d/%b/%Y:%H:%M:%S" - ] - ] + "logs": { + "logs_collected": { + "files": { + "collect_list": [{ + "file_path": "/var/log/httpd/access_log", + "log_group_name": {"Ref": "WebServerLogGroup"}, + "log_stream_name": "{instance_id}/apache.log", + "timestamp_format": "%d/%b/%Y:%H:%M:%S %z" + }] + } + } + } @@ -201,3 +165,3 @@ The two metric filters describe how the log information is transformed into Clou - "mode": "000400", - "owner": "apache", - "group": "apache" + "mode": "000644", + "owner": "root", + "group": "root" @@ -206,10 +170 @@ The two metric filters describe how the log information is transformed into Clou - "content": { - "Fn::Join": [ - "", - [ - "<?php\n", - "echo '<h1>AWS CloudFormation sample PHP application</h1>';\n", - "?>\n" - ] - ] - }, + "content": "<?php\necho '<h1>AWS CloudFormation sample PHP application on Amazon Linux 2023</h1>';\n?>\n", @@ -227,3 +182 @@ The two metric filters describe how the log information is transformed into Clou - { - "Ref": "AWS::StackId" - }, + {"Ref": "AWS::StackId"}, @@ -232,3 +185 @@ The two metric filters describe how the log information is transformed into Clou - { - "Ref": "AWS::Region" - }, + {"Ref": "AWS::Region"}, @@ -252,3 +203 @@ The two metric filters describe how the log information is transformed into Clou - { - "Ref": "AWS::StackId" - }, + {"Ref": "AWS::StackId"}, @@ -257,3 +206 @@ The two metric filters describe how the log information is transformed into Clou - { - "Ref": "AWS::Region" - }, + {"Ref": "AWS::Region"}, @@ -268 +215 @@ The two metric filters describe how the log information is transformed into Clou - "sysvinit": { + "systemd": { @@ -273,3 +220,3 @@ The two metric filters describe how the log information is transformed into Clou - "sendmail": { - "enabled": "false", - "ensureRunning": "false" + "php-fpm": { + "enabled": "true", + "ensureRunning": "true" @@ -288,66 +235,20 @@ The two metric filters describe how the log information is transformed into Clou - "ImageId": { - "Fn::FindInMap": [ - "RegionMap", - { - "Ref": "AWS::Region" - }, - "AMI" - ] - }, - "KeyName": { - "Ref": "KeyName" - }, - "InstanceType": "t1.micro", - "SecurityGroups": [ - { - "Ref": "WebServerSecurityGroup" - } - ], - "IamInstanceProfile": { - "Ref": "LogRoleInstanceProfile"