Hairdo and welcome back.
Now in today's video, we will be discussing about the Elby access laws.
Now, access logs are very important, not only from the perspective of site reliability, but also
from the perspective of security.
So it is very important that whatever Web server or load balancer that we have, the access logs should
always be nearby.
Now, before we go and look into how we can do that, let's look into our access logs at the first place
known as in both terms.
And Access Log is a list of all the request for individual files that people have requested for from
a specific Web site.
So this screenshot is basically assemble access logs from one of the servers that we are running for
a different course.
And if you'll see, you'll always when you go in and explore access logs, you'll also see a lot of
interesting things.
For example, someone from this specific IP from one 114000 is trying to make a get request on topic
blocked in.
This is interesting when someone is trying to make a hit request on robots to.
And in any event, ever you go ahead and explode the access logs, you'll see various things like someone
is trying to find an admin panel.
So they'll make a get request to admin dot BHP or various other admin.
Don't extend tenure so that they can find the admin panel that they can, but form a brute force attack
into it.
So this is one of the reasons why access logs not only gives you detailed information related to the
IP address, and then you can map from which country you're from, which city users are visiting from.
And along with that, you can also look into the type of request that is been happening and create various
VAF rules accordingly.
Now, when it comes to the Elby, do not that by default that access logs are not really enabled, so
you'll have to explicitly enable them.
So EAB also provides access logs that capture detailed information about the requests sent to your load
balancer.
So this is how architecture would really look like.
So on the left hand side, you have users, you have the elastic load balancer.
And if you have enabled the access logs, then Elby will go ahead and push the access lot to the S3
bucket.
Now, again, the question that comes is what exactly the access log contains.
It contains, which is information related to the IP address from which the user has visited the website.
The timestamp on which the request was made, the type of request you have a gate request, and also
the other that the user is trying to open.
In this case, it is stopping block chain.
If you'll go down, someone is trying to open the big graphic design and so on.
And then it also shows you the UDP code, like four zero four and various others.
So let's do one thing.
Let's go ahead and look into how access logs can be enabled at Elby level.
Now for today's video, I have an application load balancer that is already created.
Now, once you load balancer is created, when you go ahead and did the attributes associated with it.
One of the attributes here is the access logs.
So all you need to do is you have to go ahead and enable it.
Now, as we were discussing in the diagram, that the Elby node will push the access logs to a specific
S3 bucket.
So whenever you go ahead and enable access locks, you also have to specify these three bucket me so
you can specify the bucket name.
Now for today's demo, I already have a bucket is Mike Epilepsia, open access hyphen logs that describe
it.
So I'll simply go ahead and use this bucket.
And that's about it.
No, we will not be using this specific bucket that I have created.
We'll be discussing why we will not be using that.
Instead, I'll go ahead and click on create this location for me.
So let me just call it is Mike epilepsy STEM access logs.
Once you have specified this bucket, let's go ahead and click on Steve.
Great.
No, within the second.
So a new bucket caller's mike epilepsy haven tempo open access logs automatically got created.
And if you look into this bucket, you already have a directly structure.
So there's logs followed by the Agong, followed by a ELB access log testified.
So this test file will automatically be pushed whenever you go ahead and enable the access logs here.
So let's do one thing.
Let's quickly verify this thing really works.
So let's copy the DNS name associated with the Elby.
I'll paste it within the browser.
And then specifically uara of taste, Dorte, and I'll present now immediately.
Yet you'll see Fazil zero three service temporarily unavailable.
That is fine.
You do not really need a working Web site for Elby.
All you need is you need to have a working elby.
And you can send a request to that.
Now, this specific request will also be logged in these three bucket.
Now, if I'll quickly go to these three and let's rephrase the page, you will see a new log file has
not yet to be.
Generated primarily because the logs from the Elby, so the logs from the EAB, I've not pushed to the
S3 book and didn't videotape.
So you will have to wait for a specific time in Durban, like five minutes pause to which the Elby note
will push the logs to S3 bucket.
So there is a waiting time here.
So till that time, let's look into some of the important point is related to the access logs.
First, important point to as we were discussing, his dad to access logging is an optional feature
of Elby and it is disabled by default.
So after you have created Lizzi, you're creating a elby.
And after you have created Elby, you can.
Gordon added that tribute's and enable the access logging here.
The second very important point that you need to note is that Elby Logs study request on the best effort.
Biz's Eatables recommends that you make use of this access logs to understand the nature of the request.
However, you should not use it as a complete accounting for all the requests.
Very important part to remember.
Let's say you have thousands of requests that are coming.
It does not really guarantee that everything will be logged.
There can be certain requests that might not be logged.
So this is one important part to remember.
The next important part that you need to note is that the bucket and your load balancer must be within
the same region.
The last important point of this late Azur discussing is that the Elby publishes a log file for each
load balancer node every five minutes.
So you need to wait, Daudier.
And the second point that due to which we did not really use our existing bucket is that the bucket
policy should be designed so that the database account must be able to write to your bucket.
Do not yet.
Eatables account must be able to write to your rescue bucket, not the Elby must be able to write to
a bucket.
This is very important part to remember.
Let's look into it now from the stricken.
So let's quickly refresh.
And now you see you have an elastic load balancing under the epi southeast one.
Let's quickly open this up and you should have this file.
So this is how to access log file.
Looks like the extension type is jesi.
Let's open this up.
I download it.
So basically within this archive, you have this file.
Let's open this up.
So this is how it looks like.
So within here, you will basically see you array, which is this not DHC.
So this was the query that we had to meet.
You have a file 03.
So this is the S&P response score.
That type of request was a gift and it also shows you various other information.
You're great.
So this is one part.
The next part that we were discussing is related to the access policies.
So when you quickly look into the bucket policy associated with this as three bucket, let's go big
down.
So within this bucket policy, one interesting thing that you'll see is under this principle element
where you have an account number, so this is the account number that has the permission to go ahead
and put the object to R S3 bucket.
Now, do know that this is not my current account number.
So if you see my current account number is four entreaty.
However, this account number is completely different here.
And this is the reason why we were discussing that a bucket policy should be designed.
So that of account must be able to write to your bucket.
Now, again, one interesting thing today itself, before we were planning to record Arvidson Elby,
I says, look, I got a message from one of our user.
He was having trouble implementing the access logs.
And one of the mistakes that he had done was he had not added the account number of DWC site.
He basically had added his own account number here under the principle element and you to which things
were not working.
Now, one of the question that comes is, while you're creating this policy from scratch on the existing
bucket, how do you find this specific account number?
Let's look into it now within the documentation associated with access logs for your application load
balancer.
Let's go back down again.
It contains a lot of information related to the basic syntax.
So this basically allows you to understand your logs better.
But the one thing that we're interested yould let's go big down is this account data.
Now, depending upon the region, it has multiple accounts.
So for us East one run the elastic load balancer account Redis one, two, seven, three.
And basically are Elby is stored in the AP Southeast one region, which is the single region.
Let's quickly find that out.
So this is the AP Southeast one.
Now, and if you look into the account, delete is one four seven seven.
Similar to what is written within the principal element.
Don't do note that in the principal element, you have to specify this account ID.
However, in the resource element, the.
A county that needs to be maintained is your account tied with the Elby access log, needs to be stored.
Now, one of the simplest way that I can generally recommend is that you can either refer to the documentation.
So you see you have the documentation where things are clearly stated so you can go ahead and replace
it from you.
Or in case if you're using it for a test purpose, instead of creating a stream bucket from scratch
while creating a elby, let Elby create a three bucket for you so that the entire bucket policy also
gets created for you.
So these are two options that you can choose.
Get it?
So that's the High-Level Worldview about the Elby Access Logs, and that this will conclude today's
video.