Hi, everyone, and welcome back.
Now, in the earlier video we were discussing about the basics of centralized logging based architecture
and also the advantages that it provides.
Now, in today's video, we'll go ahead and implement it.
The service that we'll be using is cloud, and we'll look into how the cross account cloud trail log
configuration really works.
Now, similar to the diagram, we will have one error this account where our S3 bucket would be created.
In this second account, we will have a cloud trail and we'll look into how the cloud trail can send
the logs to the S3 bucket.
Now, similar to the architecture that we were discussing, I have two tabs.
First one is associated with a logging account and second tab is associated with that production account.
So we then are logging an account.
Let's quickly open up the S3 service and in the production address account let's open up the cloud trail
service.
Now we then are logging account.
Let's quickly create a new S3 bucket and you can give any name.
I'll just call it escape lapse cloud trail, central bucket.
All right.
Let's go ahead and we'll create a bucket.
Now from a cloud console of production account.
Let's go ahead and quickly create a new trail.
I'll just call it as the mo hyphen trail.
And within here you'll have to specify the S3 bucket where the logs will be stored.
Now, within there, ideally, we should be specifying.
Our new S3 bucket which escape laps cloud trail central bucket.
Now do note that you cannot directly store the cloud logs from one account to another accounts S3 bucket
with a default configuration.
For example, if a cloud trail of account A wants to store its data to the S3 bucket of account B,
then the bucket of account B must allow the cloud trail service to put the logs.
Otherwise, this gross account configuration would not really work.
So what you need to do in this S3 bucket of the logging account, you will have to add a new bucket
policy that allows the cloud service to add the logs towards the S3 bucket.
So what we need to do in our bucket, let's quickly go to permissions.
And within here, you will have to add a new bucket policy.
Now for today's demo, I already have a three bucket policy which allows cloud rail to add the logs
towards the bucket.
Now let's quickly look into this policy again.
I'll be attaching this policy after this video so that you can also reference it.
Now, if you look into this bucket policy, what we are doing, we are allowing the cloud rail service,
which is cloud rail dot, Amazon dot com to perform two operations.
First one is the gate bucket ACL and second one is the put object.
Put object is important because the cloud service must be able to add some data to this S3 bucket and
then we are specifying the resource.
And under the resource you have the bucket.
So a very simple bucket policy.
Let's copy this and let's add it over here.
Now, one thing that you will have to change is the bucket, so you can copy the bucket here and here.
In fact, let me zoom in so it is visible.
Great.
So within the resource, let me add the bucket.
So I'll replace the bucket in both of the resource sections.
All right, let's zoom out.
Once this is, then you can go ahead and save the changes.
So at this stage you are getting an error.
Let's look into it.
It states policies must be valid, json and the first byte must.
Okay, so one thing that you will have to take care is that you have to ensure that there is no extra
spacing.
So let's remove the space over here.
So generally this happens when you copy and paste the bucket policies.
Once this is done, you can save the change.
All right, so our bucket policy is ready.
So now comes the time where you can go ahead and specify the bucket details here.
So let me copy the name of the bucket and let's add it over here for simplicity will not really use
the CMS for encryption and within the storage location instead of creating a bucket will click on use
existing S3 bucket.
Let's copy that bucket over here.
Once this is, then you can go ahead and click on next.
And click on Next again.
And click on Create.
All right.
So once this is created, let's go back to our objects over here.
Let's refresh and automatically you see a new folder is created.
And in this folder you will typically get the account number associated with the cloud log.
So in this case, the account number is ending with four, seven, six three, which matches the account
number that is running in a second tab.
Great.
So I hope with this you understood the basics of cross account logging based on the cloud trail service.
Now again, as we are discussing that there are multiple services in place and each service generates
its own set of logs.
So depending upon the service that you choose, the cross account logging might be straightforward as
we have seen as cloud trail, or it might involve a few more steps.
So depending upon the service, the overall process would also change.
But at a high level overview, the primary aim of this video was to understand the cross account logging
from a practical point of view, and this is one of the reasons why we had taken one of the services,
which is cloud for today's demo.
So this will conclude today's video.