Prerequisites AWS ServiceLogs

Prerequisites

  • Step-by-Step Sequence for a Successful Implementation of AWS Servicelogs

  1. AWS Account

    Users must have an active AWS account with AWS services configured to forward logs to an S3 buckets or CloudWatch Log Groups or EventBridge Rules.

  2. IAM Role

    An IAM Role is created specifically for Rakuten Sixthsense AWS configurations within the respective AWS account. The ARN of this IAM Role is included in the policy attached to the IAM User and is also passed to the Lambda function.

    Create and Attach Policy to IAM Role

    Create a policy refer: permissions required to fetch and forward logs from log sources (S3 Buckets, CloudWatch Log Groups, EventBridge Rules), and attach it to the IAM Role created for Rakuten Sixthsense AWS Configurations within the respective AWS account.

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Action": [
// If s3 log forwarding is required
"s3:GetObject",
// If Event bridge log forwarding is required
"events:ListRules",
"events:DescribeRule",
"events:ListTargetsByRule",
// Optional: If log groups need to be created for logging/debugging purpose of the log forwarding
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
}
]
}

  1. IAM User

    An IAM User is created specifically for Rakuten Sixthsense AWS configurations within the respective AWS account. This IAM User must have valid credentials (Access Key ID and Secret Access Key) to enable Rakuten Sixthsense authentication.

    Create and Attach Policy to IAM User

    Create a policy refer: permissions required to create Lambda functions and list log paths/files from log sources (S3 Buckets, CloudWatch Log Groups, EventBridge Rules), and attach it to the IAM User created for Rakuten Sixthsense AWS Configurations within the respective AWS account.

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "GeneralPermissions",
// Allows actions for managing Lambda, S3, CloudWatch Logs, EventBridge, and basic identity/region operations.
"Effect": "Allow",
"Action": [
// IAM and STS actions for identity and policy simulation
"iam:SimulatePrincipalPolicy",
"sts:GetCallerIdentity",
"ec2:DescribeRegions",
// Lambda function management
"lambda:CreateFunction",
"lambda:GetFunction",
"lambda:DeleteFunction",
"lambda:UpdateFunctionConfiguration",
"lambda:InvokeFunction",
"lambda:AddPermission",
"lambda:RemovePermission",
// S3 bucket listing and notification configuration
"s3:ListAllMyBuckets",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:GetBucketNotification",
"s3:PutBucketNotification",
// CloudWatch Logs group and filter management
"logs:DescribeLogGroups",
"logs:PutSubscriptionFilter",
"logs:DeleteSubscriptionFilter",
// EventBridge rule and target configuration
"events:ListRules",
"events:PutTargets",
"events:RemoveTargets"
],
"Resource": "*"
},
{
// Allows passing a specific IAM role to Lambda only
"Sid": "AllowPassSpecificRoleToLambda",
// Permits passing a specific IAM role to Lambda with a condition to restrict it to the Lambda service.
"Effect": "Allow",
"Action": "iam:PassRole",
"Resource": "<roleARN>",
"Condition": {
// Restricts the pass role action to the Lambda service
"StringEquals": {
"iam:PassedToService": "lambda.amazonaws.com"
}
}
}
]
}
  • Note: Convention of role ARN arn:[partition]:iam::[account-id]:role/[role-name]
    1. partition - For standard AWS regions, it's aws. For GovCloud or china, it might be different (e.g., aws-us-gov).
    2. account-id — The 12-digit AWS account number where the role exists.
    3. role-name — The name of the IAM role you created in that account for Rakuten Sixthsense AWS Configuration.

List of permissions used in above policy configurations

Below is a list of AWS IAM policy permissions required to install AWS ServiceLogs. These permissions allow the creation of AWS Lambda functions and the attachment of triggers based on user configurations.

Log Forwarding types: S3 Bucket(S3), Cloudwatch LogGroup(CWL), EventBridge Rules(EB).

PermissionDescriptionConfigured in Policy attached toRequired for which log forwarding type
iam:SimulatePrincipalPolicySimulates policy to validate permissions during development or auditing. (Checking if all the necessary permissions are present)IAM UserS3 or CWL or EB
sts:GetCallerIdentityVerifies the caller's AWS account and identity for secure operations.IAM UserS3 or CWL or EB
ec2:DescribeRegionsLists AWS regions to validate or select regions for Lambda deployment.IAM UserS3 or CWL or EB
s3:ListAllMyBucketsLists buckets to allow users to select one as a Lambda trigger source.IAM UserS3
s3:GetBucketLocationChecks a bucket’s region to ensure compatibility with Lambda.IAM UserS3
s3:ListBucketInspects bucket contents to validate prefixes for triggers.IAM UserS3
s3:GetBucketNotificationRetrieves bucket notification settings to avoid trigger conflicts.IAM UserS3
s3:PutBucketNotificationConfigures bucket notifications to trigger Lambda functions.IAM UserS3
lambda:CreateFunctionCreates a new Lambda function based on user input.IAM UserS3 or CWL or EB
lambda:GetFunctionRetrieves function details to verify existence or configuration.IAM UserS3 or CWL or EB
lambda:DeleteFunctionDeletes a Lambda function if needed.IAM UserS3 or CWL or EB
lambda:UpdateFunctionConfigurationUpdates function settings (e.g., timeout, memory).IAM UserS3 or CWL or EB
lambda:AddPermissionGrants permissions for triggers to invoke the Lambda function.IAM UserS3 or CWL or EB
lambda:RemovePermissionRemoves trigger permissions when updating or deleting triggers.IAM UserS3 or CWL or EB
logs:DescribeLogGroupsLists log groups to manage logging for Lambda functions.IAM UserCWL
logs:PutSubscriptionFilterConfigures log subscriptions for monitoring or analytics.IAM UserCWL
logs:DeleteSubscriptionFilterRemoves log subscriptions when no longer needed.IAM UserCWL
events:PutTargetsAdds Lambda functions as targets for EventBridge rules.IAM UserEB
events:RemoveTargetsRemoves Lambda targets from EventBridge rules.IAM UserEB
events:ListRulesLists EventBridge rules to validate or manage triggers.IAM User, IAM RoleEB
s3:GetObjectAllows the role to read (download) objects from an S3 bucketIAM RoleS3
events:DescribeRuleAllows role getting detailed information about a specific EventBridge rule.IAM RoleEB
events:ListTargetsByRuleAllows listing all the targets (actions triggered) associated with a specific EventBridge rule.IAM RoleEB
logs:CreateLogGroupAllows creating new CloudWatch Log Groups. If log groups need to be created for logging/debugging purpose of the log forwarding (Optional)IAM RoleS3 or CWL or EB (Optional)
logs:CreateLogStreamAllows creating a log stream within a CloudWatch Log Group. If log groups need to be created for logging/debugging purpose of the log forwarding (Optional)IAM RoleS3 or CWL or EB (Optional)
logs:PutLogEventsAllows writing log events (actual log messages) into a log stream. If log groups need to be created for logging/debugging purpose of the log forwarding (Optional)IAM RoleS3 or CWL or EB (Optional)

Please proceed for configuration of AWS ServiceLogs: