TMA-AWS-4.10
Ensure all AWS-managed web front-end services have access logging enabled
Açıklama
Ensure that access logging is enabled for all AWS-managed web front-end services that terminate or front HTTP(S) traffic, including Amazon CloudFront distributions, Application Load Balancers (ALB), Network Load Balancers (NLB), and Amazon API Gateway REST/HTTP API stages with public endpoints. Access logs must be enabled with delivery to a designated S3 bucket or CloudWatch Logs destination that is protected with appropriate access controls. This control requires logging of request details such as client IP address, timestamp, HTTP method, requested URI, response status code, bytes transferred, and user agent for every request processed by these services. CloudTrail provides management event logging for these resources, but access logs are required to capture the actual HTTP request/response activity at the network edge layers. AWS-managed web front-end services (CloudFront, ALB/NLB,...
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
As an example with CloudFront, verify following the below steps if access logging is enabled: 1. Open the CloudFront console from the AWS Management Console. 2. Click Distributions in the left navigation. 3. For each Distribution ID (e.g., E123ABC...), click the Distribution ID and go to the "Logging" tab 4. Check if one or more "Access log destinations" are present with a destination type of S3 or CloudWatch log group.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Following instructions enable standard access logging for CloudFront distributions using the AWS Management Console. 1. Open the CloudFront console from the AWS Management Console. 2. Click Distributions in the left navigation and click on the Distribution ID needing remediation. 3. Go to the "Logging" tab and click on "Create access log delivery" - Select "Deliver to" for your preferred location: S3 or CloudWatch log group - Select the ARN of your log destination resource - Click on Submit 4. Confirm if you see the access log destination in the logging tab
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- access-controlawscloudlogging
- Referans
- CIS Amazon Web Services Foundations Benchmark v7.0.0 - 4.10 Ensure all AWS-managed web front-end services have access logging enabled