Skip to content

Use an existing AWS CloudTrail

If you want to add an AWS environment to Sophos Cloud Optix using an existing CloudTrail, not a new one, you must configure it first.

The key steps are as follows:

  1. Review your trail.
  2. Configure SNS topic and access policy.
  3. Configure S3 bucket notifications.
  4. Add AWS account with existing CloudTrail to Sophos Cloud Optix.

Review your trail

  1. Sign in to Amazon CloudTrail console.

  2. In your CloudTrail dashboard, copy your export bucket name.

    You'll use the name to configure the SNS topic and later need it for the Sophos Cloud Optix setup.

  3. You can also copy the S3 bucket prefix to use later. Bucket prefixes are optional.

  4. (Optional) Copy the S3 bucket prefix for later use.

    For more details on S3 bucket prefixes, see the steps in Creating a Trail.

    The following image shows an example of how to select the bucket name and bucket prefix.

    Sections of CloudTrail location to copy for bucket name and prefix in Optix.

Configure SNS topic and access policy

  1. Sign in to Amazon SNS console.
  2. Create an SNS topic in the same region where you use your S3 bucket to export CloudTrail or edit an existing SNS topic.
  3. Copy the name of this SNS topic.

  4. In the JSON editor, specify the access policy as follows:

    1. Copy the following JSON code.

      {
    "Version": "2012-10-17",
    "Statement": [
    {
        "Sid": "__default_statement_ID",
        "Effect": "Allow",
        "Principal": {
            "Service": "s3.amazonaws.com"
        },
        "Action": [
            "SNS:Publish"
        ],
        "Resource": "arn:aws:sns:us-west-1:%ACCOUNT_ID%:%SNS_TOPIC_NAME%",
        "Condition": {
            "StringEquals": {
                "AWS:SourceArn": "arn:aws:s3:::%S3_BUCKET_NAME%"
            }
        }
    }
    ]
}

    2. Replace the Resource value with the SNS ARN you're using.

    3. Replace the bucket name in Condition with the CloudTrail bucket name you copied earlier.

      Here's an example:

      SNS topic JSON editor with lines to be customized.

      While the access policy may appear optional in AWS, it's mandatory with Sophos Cloud Optix. You must configure it to turn on S3 bucket notifications.

  5. Save the SNS topic.

Configure S3 bucket notifications

  1. Sign in to Amazon S3 console.
  2. Go to your S3 bucket.
  3. To set up a new notification event, select Properties > Event notifications > Create event notification.
  4. Check that you don't have any existing notifications set on CloudTrail for creating events.
  5. Enter a name for the notification event.

  6. To create your Prefix value, enter the bucket prefix you copied earlier, followed by /AWSLogs/, your account ID, and then /CloudTrail/.

    The format must be: <Bucket-prefix>/AWSLogs/<AccountId>/CloudTrail/

    When you use an AWS Organizations-managed CloudTrail or export CloudTrails from multiple accounts into a single account, you must either leave the prefix blank or create a distinct event for each account ID.

  7. Enter json.gz as the Suffix value.

  8. Select All object create events.

  9. Set Destination to SNS topic and use the name of the SNS topic you created earlier.

    Here's an example:

    Events menu settings.

  10. Click Save changes.

Success notifications now appear in your S3 bucket properties.

Go to Sophos Cloud Optix and continue with the Add your AWS environment assistant.

Add AWS account with existing CloudTrail to Sophos Cloud Optix

To add the AWS account with existing CloudTrail to Sophos Cloud Optix, do as follows:

  1. Sign in to your Sophos Cloud Optix.
  2. Click Add Environments then click AWS.
  3. Click Choose a full setup option.
  4. Click AWS CloudShell or CLI (Linux and Mac only) or the relevant Go button.
  5. Select Customize your setup and click Continue.
  6. In CloudTrail Logs Setup Options, set Export CloudTrail logs to Cloud Optix to Yes.
  7. In Create new resources or use existing infrastructure, select Use existing resources.

  8. Enter your SNS and S3 bucket details.

    Note

    Make sure to set the S3 Bucket Prefix with the bucket prefix you copied earlier.

  9. Click Continue.

  10. Finish the Add your AWS Environment assistant.

    You can set the rest of the options according to your needs.

  11. Click Continue.

  12. Follow the on-screen instructions to add your AWS account to Sophos Cloud Optix.

    The assistant creates your script and other commands. After the script finishes, you'll see the message: All steps done!.

  13. If there are no errors, click Finish.

The AWS account is added and appears in Environments.