Add and connect an AWS audit account with AWS CloudTrail and Control Tower configured to allow Trend Vision One to provide security for your multi-account AWS environment.
If you use an audit account to monitor and collect logs from your AWS Log Archive
account, you can add the audit account to the Cloud Accounts app and enable the XDR
for Cloud - AWS CloudTrail feature to allow Trend Vision One to access your cloud service to provide
security and visibility into your cloud assets across multiple accounts. Some Cloud
Account features have limited support for AWS regions. For more information, see
AWS supported regions and
limitations.
The steps below detail how to set up an S3 bucket in your AWS audit account to
receive replicated Control Tower logs from your AWS Log Archive account, then how
to
deploy the Cloud Accounts stack to your AWS audit account.
![]() |
ImportantThe steps are valid for the AWS console as of July 2024.
You must enable Control Tower and ensure your AWS Log Archive and AWS Audit
accounts are set up before using these steps to connect to Trend Vision One with XDR for Cloud - AWS CloudTrail
enabled.
|
Procedure
- Before you begin, sign in to the Trend Vision One console, your AWS Log Archive account, and
the AWS audit account.
Tip
For best results, sign in to Trend Vision One and the AWS audit account on separate tabs in the same browser session. Use a different browser to access the AWS Log Archive account. - In the AWS audit account, create an S3 bucket to collect the replicated data
from the Control Tower on the log archive account.
- Go to .
- Click Create bucket.The Create bucket screen appears.
- For Bucket type, select General purpose.
- Provide a unique name for the bucket.
Important
Do not use the prefix"aws-controltower"
when naming the S3 bucket in your audit account. This might disable your ability to edit or delete the bucket due to restrictions imposed by AWS Control Tower. - Under Bucket Versioning, select Enable.
- Leave all other settings as default and click Create
bucket.The S3 bucket is created. For the following steps, this topic uses the term "audit bucket" to refer to this S3 bucket.
- Configure an Amazon EventBridge for the audit bucket.
- Go to .
- Locate the audit bucket and click the bucket name to open the Bucket details screen.
- Go to .
- Click Edit.
- For Send notifications to Amazon EventBridge for all events in this bucket, select On.
- Click Save changes.
- In your AWS Log Archive account, create a replication rule for the Control
Tower bucket.
- Sign on to your AWS Log Archive account and go to .
- Locate the Control Tower bucket you want to monitor and click the
name.
Tip
Type the prefix aws-cloudtrail to filter the list and find the bucket more easily. - In the Bucket details screen, go to .
- Click Create replication rule.
- Specify a name for the rule.
- Make sure the status is set to Enabled.
- Under the Source bucket section, choose the rule
scope.
-
If you only want select data to be replicated, select Limit the scope of this rule using one or more filters. Choosing this option requires you to define filters for replicated data.
-
To replicate all data, select Apply to all objects in the bucket. Trend Micro recommends using this configuration to maximize visibility into your cloud environment.
-
- Under the Destination section, select Specify a bucket in another account.
- For Account ID, paste the account ID for the AWS audit account.
- For Bucket name, paste the name of the audit bucket.
- Select Change object ownership to destination bucket owner.
- Under IAM role, the role should select
automatically.If no IAM role is available, create a new IAM role.
- Click the IAM role to open the IAM role details in a new tab.
- Go to Permissions and click Edit.
- Verify the permissions contains the following code. If not, copy and
paste the following:
{ "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ReplicateTags", "s3:ObjectOwnerOverrideToBucketOwner" ], "Effect": "Allow", "Resource": [ "THE_ARN_OF_S3_BUCKET_IN_LOG_ARCHIVE_ACCOUNT/*", "THE_ARN_OF_AUDIT_BUCKET_IN_AUDIT_ACCOUNT/*" ] }
Replace the following parameters in theResource
attribute:-
THE_ARN_OF_S3_BUCKET_IN_LOG_ARCHIVE_ACCOUNT
: The ARN of the Control Tower bucket you want to replicate. -
THE_ARN_OF_AUDIT_BUCKET_IN_AUDIT_ACCOUNT
: The ARN of the audit bucket.
Important
You must include/*
at the end of both ARN values inResource
. For example, if your audit bucket arn isaws:arn::12345:audit.bucket
, the value to input is "aws:arn::12345:audit.bucket/*". -
- Click Next, then click Save changes.
- Go back to the tab to configure the replication rules.
- Leave all other settings as default and click Save.
- When prompted, select whether or not to replicate existing objects and click Submit.
- Configure the audit bucket policies.
- In the AWS audit account, go to .
- Locate the audit bucket and click the name to access the Bucket details screen.
- Go to .
- Click Edit.
- Copy and paste the following policy.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AUDIT_BUCKET_NAME", "Effect": "Allow", "Principal": { "AWS": "ARN_OF_CONTROLTOWER_BUCKET_REPLICATION_IAM_ROLE" }, "Action": [ "s3:ReplicateObject", "s3:ReplicateDelete", "s3:ObjectOwnerOverrideToBucketOwner", "s3:ReplicateTags" ], "Resource": [ "ARN_OF_THE_AUDIT_BUCKET_IN_AUDIT_ACCOUNT/*" ] } ] }
Replace the following parameters:-
AUDIT_BUCKET_NAME
: The name of the audit bucket. -
ARN_OF_CONTROLTOWER_BUCKET_REPLICATION_IAM_ROLE
: The ARN of the IAM role assigned to the replication rule you created for the Control Tower bucket in the AWS Log Archive account. -
ARN_OF_THE_AUDIT_BUCKET_IN_AUDIT_ACCOUNT
: The ARN of the audit bucket. You must include/*
at the end of the ARN.
-
- Click Save changes.
- Create an Amazon SNS topic in the AWS audit account.
- Go to .
- Click Create topic.
- Select Standard.
- Type a name for the topic.
- Leave the remaining settings default and click Create topic.
- Create an EventBridge in the AWS audit account.
- Go to .
- Click Create rule.
- Type a name for the rule.
- Leave the remaining settings default and click Next.
- Under Creation method, select Use pattern form.
- In the Event pattern section, for Event source, select AWS services.
- For AWS service, select Simple Storage Service (S3).
- For Event type, select Amazon S3 Event Notification.
- For Event type specification 1, select Specific event(s), then select Object Created.
- For Event type specification 2, select Specify bucket(s) by name.
- Paste the name of the audit bucket in the Specify bucket(s) by name field.
- Click Next.
- For Target 1, select AWS service as the target type.
- Under Select a target, select SNS topic.
- Under Topic, select the SNS topic you created.
- Click Next, and click Next again.
- On the Review and create screen, click Create rule.
- In the Trend Vision One console, go to .
- Click Add Account.The Add Cloud Account window appears.
- Select Single AWS Account.
- Specify the general information for the account.
- Specify the Account name to display in the Cloud Accounts app.
- Specify a Description to display in the Cloud Accounts app.
- In a separate browser tab, sign into your AWS audit account.
- Select the AWS region for CloudFormation template
deployment.
Note
The default region is based on your Trend Vision One region.Some features and permissions have limited support for some AWS regions. For more information, see AWS supported regions and limitations. - Under Features and Permissions, enable Cloud Detections for AWS CloudTrail.
- Expand Cloud Detections for AWS CloudTrail and then enable Control Tower deployment.
- If you have more than one Server & Workload
Protection Manager instance, select the instance to associate with the connected
account.
Note
-
If you only have one Server & Workload Protection Manager instance, the account is automatically associated with that instance.
-
- Launch the CloudFormation template in the AWS
console.
- If you want to review the stack template before launching, click Download and Review Template.
- Click Launch Stack.
Your AWS audit account opens to the CloudFormation service on the Quick create stack screen. - Scroll down to Parameters and locate the section labeled
These are the parameters required to enable service cloud audit
log monitoring control tower.Provide the values for the following parameters:
-
CloudAuditLogMonitoringCloudTrailArn: The ARN of aws-controltower-BaselineCloudTrail.
-
CloudAuditLogMonitoringCloudTrailS3Arn: The ARN of the audit bucket.
-
CloudAuditLogMonitoringCloudTrailSNSTopicArn: The ARN of the SNS topic you created in your AWS audit account.
Important
-
The monitored CloudTrail and CloudTrail SNS must be on the same account and located in the same region you selected for the template deployment.
-
Do not change any other settings in the Parameters section. CloudFormation automatically provides the settings for the parameters. Changing parameters might cause stack creation to fail.
-
- In the Capabilities
section, select the following acknowledgments:
-
I acknowledge that AWS CloudFormation might create IAM resources with custom names.
-
I acknowledge that AWS CloudFormation might require the following capability: CAPABILITY_AUTO_EXPAND.
-
- Click Create Stack.The Stack details screen for the new stack appears with the Events tab displayed. Creation might take a few minutes. Click Refresh to check the progress.
- In the Trend Vision One console, click
Done.The account appears in Cloud Accounts once the CloudFormation template deployment is completed. Refresh the screen to update the table.