10

Is there a way to track changes we make to the AWS system?

For example, changes to a subnet setting, from using nat to iwg - these display a message, and then disappear.

Is there a way to get AWS to create a log so that one can track which changes were made to what and when?

The closest thing we have now is the ElasticBeanstalk events - but even that only tells you what AWS did, not which settings were changed to cause the events.

12

AWS has the CloudTrail service that tracks most of the API calls done in your account. Then stores these in files in your specified S3 bucket.

https://aws.amazon.com/cloudtrail/

Using CloudTrail you can see who, or which service, called which change - in many cases also including which arguments were used.

Unfortunately it doesn't support ALL services at the moment.

  • 4
    This answer should probably also mention AWS Config. – Michael - sqlbot May 14 '17 at 17:22
  • @Michael-sqlbot You are right. Pl add it as an answer yourself. :) – Dawny33 May 15 '17 at 9:31
  • AWS Config is not an audit log. It is a system that enables to react to events as they happen. So it's more like a firewall than a firewall audit log. And it's actually very pricey compared to the almost free CloudTrail. – Evgeny May 15 '17 at 9:48
5

There are multiple AWS services that can help with this, and it depends really on your exact needs as to which would suit you best. Different features (and costs) apply to each.

CloudTrail has been mentioned, but the the first option that comes to mind for me given your question (and it's mentioned in a comment on @Evgeny's answer) is the AWS Config Service. It stores 'snapshots' of your AWS configuration at points in time (in an S3 bucket), but helpfully also sends any changes to an SNS topic. You can then deal with these however you like. For example, on a low traffic account I have these going straight into Slack; on a high traffic account I am tracking the NumberOfMessagesPublished metric on that SNS topic to notice if a larger number of changes are made than usual.

AWS Config also offers a 'rules' service; these are a bit more pricey than I would expect them to be but depending on your needs they could be useful. Just don't activate them all at once like I did when I was playing around... the month's charge for each rule applies right away. ;) (But you can use Config without using the rules - that is what I am doing at the moment).

There's also Trusted Advisor, which doesn't do what you asked for exactly but might be handy to perform certain checks against how engineers configure your infrastructure, such as whether anyone's left S3 buckets open. It's most useful with a Business level Support plan or above, as many of its checks are blocked otherwise.

Then there's third party tools like CloudCheckr, which combine aspects of AWS Cost Explorer, Trusted Advisor, Config, CloudTrail, CloudWatch, Inspector and GuardDuty. Useful if you want to get in really deep but save time configuring everything yourself.

Alternatively, you could manage your infrastructure using a tool such as Terraform or CloudFormation, and mandate that all changes must be made through those. You can then commit your config files/templates to source control, and even test them against the live infrastructure in CI and fail the build if someone's made non-tracked changes. That way, your commit history becomes your audit log - but it does require your engineers to be disciplined!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.