AWS whitepapers documentation change
Summary
Removed entire content including sections about enabling CloudTrail, VPC Flow Logs, Route 53 resolver logs, and other security logging recommendations.
Security assessment
The change deletes security documentation about log sources but shows no evidence of addressing a specific vulnerability. Removal of security best practices guidance could negatively impact users' ability to configure logging properly, reducing incident response capabilities.
Diff
diff --git a/whitepapers/latest/aws-security-incident-response-guide/select-and-enable-log-sources.md b/whitepapers/latest/aws-security-incident-response-guide/select-and-enable-log-sources.md index ff8bd8ce1..8b1378917 100644 --- a//whitepapers/latest/aws-security-incident-response-guide/select-and-enable-log-sources.md +++ b//whitepapers/latest/aws-security-incident-response-guide/select-and-enable-log-sources.md @@ -1 +0,0 @@ -[View a markdown version of this page](select-and-enable-log-sources.md) @@ -3,37 +1,0 @@ -[](/pdfs/security-ir/latest/userguide/sir-ug.pdf#select-and-enable-log-sources "Open PDF") - -[Documentation](/index.html)[Security Incident Response](/security-ir/index.html)[](what-is.html) - -# Select and enable log sources - -Ahead of a security investigation, you need to capture relevant logs to retroactively reconstruct activity in an AWS account. Select and enable log sources relevant to their AWS account workloads. - -AWS CloudTrail is a logging service that tracks API calls made against an AWS account capturing AWS service activity. It is enabled by default with 90-day retention of management events that can be [retrieved through CloudTrail’s Event History](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html) facility using AWS Management Console, the AWS CLI, or an AWS SDK. For longer retention and visibility of data events, you need to [create a CloudTrail Trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) and associated with an Amazon S3 bucket, and optionally, with a CloudWatch log group. Alternatively, you can create a [CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html), which retains CloudTrail logs for up to seven years and provides a SQL-based querying facility. - -AWS recommends that customers using a VPC enable network traffic and DNS logs using, respectively, [VPC Flow Logs](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html) and [Amazon Route 53 resolver query logs](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs.html), streaming them to either an Amazon S3 bucket or a CloudWatch log group. You can create a VPC flow log for a VPC, a subnet, or a network interface. For VPC Flow Logs, you can be selective on how and where you enable Flow Logs to reduce cost. - -AWS CloudTrail Logs, VPC Flow Logs, and Route 53 resolver query logs are the _basic logging trifecta_ to support security investigations in AWS. - -AWS services can generate logs not captured by the basic logging trifecta, such as Elastic Load Balancing logs, AWS WAF logs, AWS Config recorder logs, Amazon GuardDuty findings, Amazon Elastic Kubernetes Service (Amazon EKS) audit logs, and Amazon EC2 instance operating system and application logs. Refer to [Appendix A: Cloud capability definitions](./appendix-a-cloud-capability-definitions.html) for the full list of logging and monitoring options. - - **Javascript is disabled or is unavailable in your browser.** - -To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions. - -[Document Conventions](/general/latest/gr/docconventions.html) - -Select and set up logs for analysis and alerting - -Select log storage - -Did this page help you? - Yes - -Thanks for letting us know we're doing a good job! - -If you've got a moment, please tell us what we did right so we can do more of it. - -Did this page help you? - No - -Thanks for letting us know this page needs work. We're sorry we let you down. - -If you've got a moment, please tell us how we can make the documentation better.