AWS VPC
Introduction
Amazon Virtual Private Cloud (Amazon VPC) lets you create a private network for your AWS resources with full control over IP address ranges, subnets, and network configurations.
Getting Started
Compatibility
vuSmartMaps supports the tracking and analysis of performance, health, and security of your Amazon Virtual Private Cloud (VPC) environment.
Data Collection Method
vuSmartMaps collects AWS VPC metrics through a data collector deployed within the vuSmartMaps platform, which uses aws-vpc to retrieve performance and health metrics.
Prerequisites
Dependent Configuration
To configure this O11ySource, create a 'credential' of type 'aws' under the 'Definition' tab.
Inputs for Configuring Data Source
- AWS VPC Name: Enter a unique name for this AWS VPC Source.
- AWS S3 Bucket ARN: ARN of the AWS S3 bucket that will be polled for list operation.
- AWS Credential: AWS credential that provides Access key and Secret key to access AWS s3 bucket.
- Bucket List Interval (in minutes): Specifies the interval in minutes at which AWS S3 bucket is refreshed. Data collection occurs once every specified period when the bucket is refreshed for new entries. The bucket list interval should be between 1 - 60 minutes.
Applications
Firewall Requirement
To collect data from this O11ySource, ensure the following ports are opened:
| Source IP | Destination IP | Destination Port | Protocol | Direction |
|---|---|---|---|---|
| vuSmartMaps Collection/Ingress node IP | AWS S3 Endpoint | 443* | TCP | Outbound |
*Before providing the firewall requirements, please update the port based on the customer environment.
Configuring the Target
The user must have the following AWS credentials:
- Access Key ID: The Access Key ID is a crucial element of AWS. It serves as an identifier for access keys used to authenticate and authorize API requests, ensuring secure communication between various AWS services and applications
- Secret Key: In AWS, the Secret Access Key is a confidential piece of information associated with an IAM user or an AWS service account. Along with the Access Key ID, the Secret Access Key is part of an access key pair used to authenticate and authorize access to AWS services programmatically
- Bucket ARN: An Amazon Resource Name (ARN) is a unique identifier assigned to S3 buckets within AWS
Following IAM policy is required in order to pull the object from S3:
- s3:GetObject: To retrieve an object from an Amazon S3 bucket
- s3:ListBucket: To list the objects within an Amazon S3 bucket. It grants permission to view the list of objects contained within the specified bucket
- s3:GetBucketLocation: To retrieve the location (region) of an Amazon S3 bucket. It grants permission to determine the AWS region where the specified bucket is located.
Configure Flow Logs to Collect from Amazon VPC Flow Logs is a feature provided by AWS that enables you to capture information about the IP traffic going to and from network interfaces in your VPC, subnet, or network interface. Flow Logs provide visibility into the network traffic within your AWS infrastructure, allowing you to monitor and troubleshoot connectivity issues, analyze traffic patterns, and enhance security. Below is the step provide how to configure the flow logs:
- Sign in to the AWS Management Console and open the Amazon VPC console.
- From the navigation panel, choose the VPC for which you want to configure flow logs.
- In the VPC dashboard, select the "Flow Logs" tab, and then click on the "Create Flow Log" button.
- Configure the flow logs and make sure you set the destination into AWS S3 bucket to store the logs.
- In the log record format, click on custom log foramt and select the standard attributes from the drop down.
- Review the configuration settings, and then click "Create Flow Log" to create the flow log.
Configuration Steps
Metrics Collected
| Name | Description | Data Type |
|---|---|---|
| @timestamp | The time when the log event was received. | String |
| Timestamp | The actual event timestamp when the network flow occurred. | DateTime64 |
| Account ID | The AWS account ID associated with the flow. | String |
| Action | Indicates whether the traffic was accepted or rejected. | LowCardinality(String) |
| Availability zone ID | The availability zone ID in which the resource resides. | String |
| Bytes | The number of bytes transferred in the flow. | Float64 |
| Destination Address | The destination IP address of the traffic. | String |
| Destination Port | The destination port of the traffic. | UInt16 |
| End Time | The end time of the network flow. | DateTime64 |
| Flow Direction | The direction of traffic, e.g., ingress or egress. | LowCardinality(String) |
| Instance ID | The EC2 instance ID involved in the traffic. | String |
| Interface ID | The network interface ID on which traffic was captured. | String |
| Log Status | The status of the log record (e.g., OK, NODATA, SKIPDATA). | LowCardinality(String) |
| Packets | The number of packets transferred in the flow. | UInt64 |
| PKT DST AWS Service | Destination AWS service associated with the packet, if any. | String |
| PKT DST ADDR | Destination address of the specific packet. | String |
| PKT SRC AWS Service | Source AWS service associated with the packet, if any. | String |
| PKT SRC ADDR | Source address of the specific packet. | String |
| Protocol | The protocol number used in the traffic (e.g., 6 for TCP). | UInt16 |
| Region | The AWS region where the flow log was captured. | LowCardinality(String) |
| SRC ADDR | The source IP address of the traffic. | String |
| SRC Port | The source port of the traffic. | UInt16 |
| Start Time | The start time of the network flow. | DateTime64 |
| Sublocation ID | Custom sublocation ID, if used for tagging or analysis. | String |
| Sublocation Type | The type of sublocation associated with the flow. | String |
| Subnet ID | The subnet ID associated with the network interface. | String |
| VPCID | The VPC ID associated with the network interface. | String |
| Country Name | Geographical country of the IP address, if resolved. | String |
| Timezone | Timezone associated with the flow (if available). | String |
| Longitude | Longitude of the source/destination, if geolocation is used. | String |
| Latitude | Latitude of the source/destination, if geolocation is used. | String |
| BU ID | Business unit identifier. | String |
| Tenant ID | Tenant identifier for multi-tenant environments. | String |
| ProtocolName | Name of the protocol (e.g., TCP, UDP). | String |
| SrcPortName | Name associated with the source port (e.g., HTTPS). | String |
| DstPortName | Name associated with the destination port (e.g., HTTPS). | String |
