Getting Started with AWS Config, CloudTrail, CloudWatch, S3, SNS
Tags: aws, security, cloud
Published: 2021-07-16 15:22:02

Security is one of the major concerns in any environment, whether you are planning to run a start-up or having an enterprise, you should always consider security before anything and have a zero-trust model.

It is better to be proactive and secure your resource than being a reactive and start implementing security after an incident, some of the reasons are:
-	Save money.
-	Save efforts.
-	Availability of your services.
-	Business reputation.
-	And many more.





`What is AWS Config?`

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.
[Source: AWS Config](https://aws.amazon.com/config/?nc1=h_ls)

In this demo, we will set up AWS Config, assign a rule to it, set up AWS CloudTrail, enable CloudWatch to monitor CloudTrail, set up S3 bucket to store our log files, and set up Simple Notification Service to receive notifications through email.

With all that being said, let’s open the console and start setting up AWS Config:

Login to your AWS account

Click on _all services_, then you will find Config under _Management & Governance_ Section, click it:

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8spjru3rdpwx9n6zdxux.png)

It will take you to AWS Config’s dashboard. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5zhp1uv8fa05z1qjyfit.png)

Click _Get started_.

Now you can start setting up your Config, 
For the resource type; you can choose _Record all resources in this region_, this will allow config to record all your resources in the region you’re currently using, and you can check the box below which says “_include global resources_” this will also get the resources that operates in a global basis such as IAM.

Now you will need an _S3 bucket_ to store your config log files, 
you have the option to choose an existing one or create a new one directly from Config’s settings, and it will suggest a name for your S3 bucket as you can see in the screenshot below.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/usj78nmqirijuxk75xns.png)

By checking the box for SNS topic you will set up a _Simple Notification Service (SNS)_ topic to provide you with notifications related to your Config. 
You have the option to create a new SNS topic or choose an existing one whether it’s from your account or another account.

For this demo, I will create a new SNS topic and give the topic a name: config-topic.

Then you can click _next_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fb2cfhf7ykcvfcf76hiw.png)

It will take you to _step 2_: to assign rules. 
As you can see below there are more than 150 rules ready to use, provided and managed by AWS,
but of course, you have the option to create your own rules.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/99rf4m6bn1py4cki4oew.png)

For this demo, I will choose an AWS managed rule.
Cloudtrail-enabled: this rule will periodically check whether AWS cloudtrail is enabled in your account or not.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kb4brdmoff5ic3d0lj24.png)

Then click _next_ and review your configurations then click _confirm_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/71lzv7yr5o7w04erk1ag.png)

Your AWS Config Dashboard will open, this is where you can add/edit/delete rules, check compliances and basically manage everything.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bsemcx91g50m4jrsxnf7.png)

Now let’s set up a CloudTrail, you can find it under _Management and Governance_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/adskg96y3mi93b7xo9ng.png)

Once you’re in the dashboard, click _create trail_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/837es56qggqgb4kwgri3.png)

Give it a name and select where do you want to store the logs;
You can use one of your existing S3 buckets, or create a new one directly from here,
I will create a new one and it will automatically provide a name for it (you can change it) you also have the option to encrypt log files using KMS, for this demo I will keep it as it is.

You can also enable Simple Notification Service (SNS) and associate it with this Trail. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zu1jqqmexgb2y8lay0q7.png)

And you have the option to enable CloudWatch logs; which will monitor your CloudTrail logs. 
I will enable it and choose a new log group then give it a name (It will provide it automatically, but you can change it).

Then you will need to assign an IAM Role to enable communication between CloudTrail and CloudWatch, I will choose a new role and give it a name.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m4w3ucc5m6lhjiah878z.png)

You will select the type of events that you want CloudTrail to log, I will select them all. 
It will ask you to specify the kind of API activities to log for the management events, I will choose the read and write activates.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vtml8j32bsijjum6ofsh.png)

For the data events, it will ask you to select the source of data, I will keep it S3; you can select a specific S3 bucket, or all current and future S3 buckets, I will keep it for _all S3 buckets_.

In insights events, you can enable the API Call rate to measure any unusual activities.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/llcjezq2mu0tnosrfr2o.png)


Click _next_, review your settings, and click _create trail_.

Now you can see our trail “CloudTrail-test” is _enabled_ and the status is _Logging_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hwg9kiun57g81to2oui5.png)

Let’s go to _S3_, you can find it under _Storage_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ijlm249lkd17bxg4kyh7.png)

You can see our S3 bucket has been created, and we can find all CloudTrail logs inside it

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uw3lsx0wpr2w8cu0q2hi.png)

 
When you click on it you will find our folders that contains logs from CloudTrail.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ix2w0t53b142ygb36g74.png)

Now let’s go to _Simple Notification Service (SNS)_, you can find it under _Application Integration_.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lf7z985qm1h6tg5og4hc.png)

You will find the Topic that we created earlier (while setting up Config) here -you will need the ARN in the next step-. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ixjwg82ml62q8ot9iuw3.png)

Let’s connect it to our email to receive notifications there.

Click on _subscriptions_ (you can find it on your left-hand side of the screen) click _create subscription_ and fill the necessary details.

Select the Topic that you want to connect to your email (your topic's ARN), and in the protocol section, select email.

For the endpoint, add your email address then create the subscription.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hsgnlkcm2cf41eqdui6y.png)

You will receive an email to confirm the subscription, click on the link that says “_Confirm Subscription_”.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5tjoix6ian8byo8icivn.png)

It will open a new web page that confirms your subscription, with your subscription ID and an option to remove the subscription.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d3kzvz7eda80f91orn68.png)

If you go back to SNS Subscriptions, you will find your subscription ID, your email address and the status is _confirmed_.  

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hj1thjf2hogc2x1rqd0e.jpg)


If you go back to AWS Config, you will find your cloudtrail-enabled rule compliant now.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3g18lrz1t7d1nwsz2vzo.png)

### Voila! 


We now have a centralized configuration dashboard associated with chosen rules to evaluate our security, CloudTrail to audit API calls, S3 bucket to store all log files and receive notifications via email.