AWS CloudTrail Audit & Security

# Tạo dedicated bucket cho CloudTrail
aws s3 mb s3://vinashoes-cloudtrail-logs-ap-southeast-1 --region ap-southeast-1

# Apply bucket policy cho CloudTrail access

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::vinashoes-cloudtrail-logs-ap-southeast-1"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::vinashoes-cloudtrail-logs-ap-southeast-1/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}

Trail Configuration:
  Trail name: "vinashoes-audit-trail"
  ✅ Apply trail to all regions
  ✅ Apply trail to all accounts in organization (nếu có)
  
Storage Location:
  ✅ Create new S3 bucket
  S3 bucket: "vinashoes-cloudtrail-logs-ap-southeast-1"
  S3 key prefix: "audit-logs/"
  
Log File Validation:
  ✅ Enable log file integrity validation
  
KMS Encryption:
  ⚠️ Optional: Enable để encrypt logs

Management Events:
  ✅ Read events
  ✅ Write events
  
Include:
  - EC2 instances start/stop
  - ECS service updates
  - API Gateway changes
  - IAM policy modifications
  - S3 bucket operations
  - DynamoDB table changes

S3 Data Events:
  ✅ Read events
  ✅ Write events
  
S3 Resources:
  - arn:aws:s3:::vinashoes-product-images/*
  - arn:aws:s3:::vinashoes-cicd-artifacts/*
  
Operations Tracked:
  - GetObject (file downloads)
  - PutObject (file uploads)
  - DeleteObject (file deletions)

DynamoDB Data Events:
  ✅ Read events
  ✅ Write events
  
DynamoDB Resources:
  - arn:aws:dynamodb:ap-southeast-1:ACCOUNT:table/User
  - arn:aws:dynamodb:ap-southeast-1:ACCOUNT:table/Product
  - arn:aws:dynamodb:ap-southeast-1:ACCOUNT:table/Order
  
Operations Tracked:
  - GetItem, Query, Scan
  - PutItem, UpdateItem, DeleteItem

CloudWatch Logs Configuration:
  ✅ Send events to CloudWatch Logs
  
Log Group:
  Name: "/aws/cloudtrail/vinashoes-audit"
  Retention: 30 days
  
IAM Role:
  Create new role: "CloudTrail_CloudWatchLogs_Role"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:ap-southeast-1:ACCOUNT:log-group:/aws/cloudtrail/vinashoes-audit:*"
    }
  ]
}

# 1. Root account usage
aws logs put-metric-filter \
  --log-group-name "/aws/cloudtrail/vinashoes-audit" \
  --filter-name "RootAccountUsage" \
  --filter-pattern '{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }' \
  --metric-transformations \
    metricName=RootAccountUsageCount,metricNamespace=Security,metricValue=1

# 2. Unauthorized API calls  
aws logs put-metric-filter \
  --log-group-name "/aws/cloudtrail/vinashoes-audit" \
  --filter-name "UnauthorizedApiCalls" \
  --filter-pattern '{ $.errorCode = "AccessDenied" || $.errorCode = "UnauthorizedOperation" }' \
  --metric-transformations \
    metricName=UnauthorizedApiCallCount,metricNamespace=Security,metricValue=1

# 3. IAM policy changes
aws logs put-metric-filter \
  --log-group-name "/aws/cloudtrail/vinashoes-audit" \
  --filter-name "IAMPolicyChanges" \
  --filter-pattern '{ $.eventName = AttachUserPolicy || $.eventName = DetachUserPolicy || $.eventName = PutUserPolicy || $.eventName = CreatePolicy || $.eventName = DeletePolicy }' \
  --metric-transformations \
    metricName=IAMPolicyChangeCount,metricNamespace=Security,metricValue=1

# Root Account Usage Alarm
Alarm Configuration:
  Alarm name: "Security-RootAccountUsage"
  Description: "Root account được sử dụng"
  
Metric:
  Namespace: "Security"
  MetricName: "RootAccountUsageCount"
  
Threshold:
  Comparison: "GreaterThanOrEqualToThreshold"
  Threshold: 1
  Period: 300 seconds
  Evaluation: 1 out of 1
  
Actions:
  - Send SNS notification immediately
  - Trigger security response procedure

# Unauthorized Access Alarm
Alarm Configuration:
  Alarm name: "Security-UnauthorizedAccess"
  Description: "Phát hiện unauthorized API calls"
  
Metric:
  Namespace: "Security"  
  MetricName: "UnauthorizedApiCallCount"
  
Threshold:
  Comparison: "GreaterThanThreshold"
  Threshold: 5
  Period: 300 seconds

# Tạo SNS topic
aws sns create-topic --name vinashoes-security-alerts

# Subscribe email
aws sns subscribe \
  --topic-arn arn:aws:sns:ap-southeast-1:ACCOUNT:vinashoes-security-alerts \
  --protocol email \
  --notification-endpoint [email protected]

# Subscribe SMS (optional)
aws sns subscribe \
  --topic-arn arn:aws:sns:ap-southeast-1:ACCOUNT:vinashoes-security-alerts \
  --protocol sms \
  --notification-endpoint +84987654321

CloudTrail Insights Configuration:
  ✅ Enable insights for management events
  
Insights Type:
  ✅ API call rate insights
  ✅ API error rate insights
  
Cost:
  $0.35 per 100,000 events analyzed

{
  "widgets": [
    {
      "type": "metric",
      "properties": {
        "metrics": [
          ["Security", "RootAccountUsageCount"],
          [".", "UnauthorizedApiCallCount"],
          [".", "IAMPolicyChangeCount"]
        ],
        "period": 300,
        "stat": "Sum",
        "region": "ap-southeast-1",
        "title": "Security Events"
      }
    },
    {
      "type": "log",
      "properties": {
        "query": "SOURCE '/aws/cloudtrail/vinashoes-audit'\n| fields @timestamp, sourceIPAddress, userIdentity.type, eventName\n| filter eventName like /Delete/\n| sort @timestamp desc\n| limit 20",
        "region": "ap-southeast-1",
        "title": "Recent Delete Operations"
      }
    }
  ]
}

-- Failed login attempts
fields @timestamp, sourceIPAddress, userIdentity.userName, errorMessage
| filter eventName = "ConsoleLogin" and errorMessage exists
| stats count() as failures by sourceIPAddress
| sort failures desc

-- S3 bucket policy changes  
fields @timestamp, sourceIPAddress, userIdentity.userName, eventName
| filter eventName like /Bucket/ and eventName like /Policy/
| sort @timestamp desc

-- ECS service modifications
fields @timestamp, sourceIPAddress, userIdentity.userName, eventName, responseElements
| filter eventName like /UpdateService/ or eventName like /CreateService/
| sort @timestamp desc

-- DynamoDB data access patterns
fields @timestamp, sourceIPAddress, eventName, responseElements.itemCount
| filter eventName = "Scan" or eventName = "Query" 
| stats count() as queries, sum(responseElements.itemCount) as totalItems by sourceIPAddress
| sort queries desc

High Priority Alerts:
  - Root account usage
  - Unauthorized API calls (5+ in 5 minutes)
  - IAM policy changes
  - S3 bucket policy modifications
  - ECS service updates outside business hours

Medium Priority:
  - Bulk DynamoDB scans
  - Cross-region API calls
  - New IAM user creation
  - S3 bucket access from unknown IPs

Compliance Events:
  - Data access patterns
  - Admin privilege usage
  - Configuration changes
  - Delete operations

-- Find who modified ECS services
fields @timestamp, sourceIPAddress, userIdentity.userName, eventName, requestParameters
| filter eventName like /ECS/ and (eventName like /Update/ or eventName like /Delete/)
| sort @timestamp desc

-- Large DynamoDB scans
fields @timestamp, sourceIPAddress, eventName, responseElements.scannedCount
| filter eventName = "Scan" and responseElements.scannedCount > 1000
| stats count() as largeScanCount by sourceIPAddress
| sort largeScanCount desc

-- IAM permission changes
fields @timestamp, sourceIPAddress, userIdentity.userName, eventName, requestParameters.policyDocument
| filter eventName like /Policy/ and requestParameters.policyDocument like /\*/
| sort @timestamp desc

Complete Stack Overview:
  Task 11: CI/CD Pipeline + Automation
  Task 12: CloudWatch Logs + Metrics + Alarms
  Task 13: X-Ray Distributed Tracing
  Task 14: CloudTrail Audit + Security
  
Benefits:
  ✅ Complete visibility into infrastructure
  ✅ Real-time performance monitoring  
  ✅ End-to-end request tracing
  ✅ Security audit trail
  ✅ Compliance-ready logging

# Dừng ghi log trước
aws cloudtrail stop-logging --name vinashoes-audit-trail

# Xóa trail
aws cloudtrail delete-trail --name vinashoes-audit-trail

# Liệt kê và xóa tất cả objects trong bucket
aws s3 rm s3://vinashoes-cloudtrail-logs-ap-southeast-1 --recursive

# Xóa tất cả delete markers và versions (nếu versioning được bật)
aws s3api delete-objects --bucket vinashoes-cloudtrail-logs-ap-southeast-1 --delete "$(aws s3api list-object-versions --bucket vinashoes-cloudtrail-logs-ap-southeast-1 --query='{Objects: Versions[].{Key:Key,VersionId:VersionId}}')"

# Xóa bucket
aws s3 rb s3://vinashoes-cloudtrail-logs-ap-southeast-1

# Xóa CloudWatch log group
aws logs delete-log-group --log-group-name "/aws/cloudtrail/vinashoes-audit"

# Xóa metric filters
aws logs delete-metric-filter --log-group-name "/aws/cloudtrail/vinashoes-audit" --filter-name "RootAccountUsage"
aws logs delete-metric-filter --log-group-name "/aws/cloudtrail/vinashoes-audit" --filter-name "UnauthorizedApiCalls"
aws logs delete-metric-filter --log-group-name "/aws/cloudtrail/vinashoes-audit" --filter-name "IAMPolicyChanges"

# Xóa CloudWatch alarms
aws cloudwatch delete-alarms --alarm-names "Security-RootAccountUsage" "Security-UnauthorizedAccess"

# Liệt kê subscriptions và unsubscribe nếu cần
SUBSCRIPTION_ARN=$(aws sns list-subscriptions-by-topic --topic-arn arn:aws:sns:ap-southeast-1:ACCOUNT:vinashoes-security-alerts --query 'Subscriptions[0].SubscriptionArn' --output text)
if [ "$SUBSCRIPTION_ARN" != "None" ]; then
  aws sns unsubscribe --subscription-arn $SUBSCRIPTION_ARN
fi

# Xóa SNS topic
aws sns delete-topic --topic-arn arn:aws:sns:ap-southeast-1:ACCOUNT:vinashoes-security-alerts

# Detach policies
aws iam detach-role-policy --role-name CloudTrail_CloudWatchLogs_Role --policy-arn arn:aws:iam::aws:policy/service-role/AWSCloudTrail_CloudWatchLogs_Role

# Xóa role
aws iam delete-role --role-name CloudTrail_CloudWatchLogs_Role

aws cloudwatch delete-dashboards --dashboard-names "Vinashoes-Security-Monitoring"

Chi Phí Cơ Bản CloudTrail:
  Management Events: MIỄN PHÍ (không giới hạn)
  Data Events (S3): $5/tháng (500K events)
  Data Events (DynamoDB): $2/tháng (200K events)
  Insights: $10/tháng (300K events được phân tích)
  
Lưu Trữ & Giám Sát:
  S3 Storage: $8/tháng (350GB logs)
  CloudWatch Logs: $15/tháng (30GB ingested)
  CloudWatch Metrics: $5/tháng (15 custom metrics)
  CloudWatch Alarms: $3/tháng (30 alarms)
  
Thông Báo:
  SNS: $2/tháng (400K notifications)
  
Tổng Chi Phí Hàng Tháng: $50/tháng

Chiến Thuật Tối Ưu:
  1. Data Events Chọn Lọc:
     - Bật chỉ cho S3 buckets quan trọng
     - Giám sát chỉ các bảng DynamoDB có lưu lượng cao
     
  2. Giữ Log:
     - CloudWatch: Giữ 30 ngày
     - S3: Chuyển sang lưu trữ rẻ hơn sau 30 ngày
     
  3. Insights Chọn Lọc:
     - Bật chỉ cho tài khoản production
     - Giám sát chỉ trong giờ làm việc
     
  4. Tối Ưu Metric Filters:
     - Sử dụng ít filters hơn, cụ thể hơn
     - Kết hợp events liên quan thành metrics đơn

# Kiểm tra chi phí CloudTrail
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=SERVICE \
  --filter '{
    "Dimensions": {
      "Key": "SERVICE",
      "Values": ["AWS CloudTrail"]
    }
  }'

# Giám sát chi phí lưu trữ S3
aws ce get-cost-and-usage \
  --time-period Start=2024-01-01,End=2024-01-31 \
  --metrics BlendedCost \
  --group-by Type=DIMENSION,Key=AZ \
  --filter '{
    "Dimensions": {
      "Key": "SERVICE", 
      "Values": ["Amazon Simple Storage Service"]
    }
  }'