AWS S3 File Integrity Monitoring

Know when Critical Files have been ACCESSED or MODIFIED

Architecture

• AWS has now capabilities for putting object level access into cloudtrail events , so we use that
• The architecture then uses cloudwatch rules to capture relevant eventNames and calls a lambda function to do the rest of the job
• The lambda function then parses the output of the cloudwatch to log which file has been modified by which user and which from source IP

Scenario

You have a S3 bucket (fimfilesjan7) that has PCI or HIPAA data and you want to monitor and log who is accessing them and get alerted when accessed by wrong users

Events Generated

The following are the events are generated whe

1. Event Name GetObject gets generated into Cloudtrail when a file is accessed
2. Event Name PutObject gets generated into Cloudtrail when a file is removed or a new file is put into a bucket

Steps

1. Create a S3 bucket — fimfilejan7
2. Create a Trail select read/write events in event selector

1. Clone the s3fim code — git clone https://github.com/vevasa/s3fim
2. zip the files zip -r s3fim.zip
3. create a lambda function

1. Create a cloud watch rule to capture GetObject and PutObject and select the just uploaded lambda job

1. Copy a file into the bucket
2. Lambda should have put the bucket name into logs -