The document discusses using AWS CloudTrail and Splunk to gain visibility into AWS API calls across multiple AWS accounts. CloudTrail logs API calls and Splunk is used to centrally aggregate those logs. Examples are provided of how this setup could be used for incident response, operations troubleshooting, and compliance auditing. The integration of CloudTrail and Splunk provides scalability and a single view across accounts for security and operations teams.

1. AWS/Splunk Big Data Webinar 10/16/2014
Strengthening Operations with
Splunk and AWS CloudTrail
Alan Williams
Principal Engineer
alanwill on Twitter & GitHub
© 2014 Autodesk

2. Who Am I?
 Engineer @ Autodesk
 Technology Generalist
 Background in Infrastructure
 AWS for ~4 years
 Splunk for ~1 year
 Motorcyclist
 Soft spot for pit bulls
© 2014 Autodesk

3. Who is Autodesk?
 Leader in 3D design, engineering and
entertainment software
 Introduced AutoCAD in 1982
 Empowering the Maker movement
 Help our customers imagine, design and create
a better world
http://www.autodesk.com/products/personal-design-and-creativity
© 2014 Autodesk

4. Problem
 How do we know what’s happening in our
accounts?
 Malicious activity?
 How can we validate that we’re compliant?
© 2014 Autodesk

5. © 2014 Autodesk

6. © 2014 Autodesk
+

7. Why CloudTrail?
 Logs AWS API calls
© 2014 Autodesk
 Visibility and analytics
 AWS native
 Simple to configure
 Point and click (most parts automatable)
 Covers almost all AWS services
 New coverage added regularly (http://goo.gl/jf9uLq)
 Available in all 8 regions (http://goo.gl/ojU7ut)

8. Why Splunk?
 Leverage existing investment
© 2014 Autodesk
 Standard log aggregation platform
 Splunk App for AWS (http://goo.gl/Xc7XsZ)
 Familiar technology
 Logging = Splunk
 Supports logging REST endpoints
 SQS & S3
 Single view across all accounts

9. CloudTrail + Splunk Architecture
Account A Account B
© 2014 Autodesk
3 3
SNS Topic
1 1
SQS Queue
CloudTrail
S3 Bucket
CloudTrail SNS Topic
2 2
4 4
5
Core Services Account
 Simple to configure
 Scalable to many accounts
 Central logging view across
all accounts

10. CloudTrail Use Cases
 Incident Response
 Operations Troubleshooting
 Compliance Auditing
© 2014 Autodesk

11. Incident Response
 Something happened in Account X
between a certain time window
 Has this compromised host made any API
calls?
 Where have these IAM keys been used?
© 2014 Autodesk

12. Something happened in Account X between a
certain time window
© 2014 Autodesk

13. Has this compromised host made any API calls?
© 2014 Autodesk

14. Where have these IAM keys been used?
© 2014 Autodesk

15. Operations Troubleshooting
 Who created this instance?
 Where in the world are sign-ins
originating?
© 2014 Autodesk

16. Who created this instance?
© 2014 Autodesk

17. Where in the world are sign-ins originating?
© 2014 Autodesk

18. Compliance Auditing
 Alert if an SG rule is created with 0.0.0.0/0
rule
 Frequency of certain events
 Alert whenever an IAM user is created
© 2014 Autodesk

19. Alert if an SG rule is created with 0.0.0.0/0 rule
© 2014 Autodesk

20. Alert whenever an IAM user is created
© 2014 Autodesk

21. Summary
 AWS CloudTrail + Splunk = Happy Marriage
 Scalable to 100s of accounts
 Toolset for Operations and Security Teams
 Our common use cases with examples
© 2014 Autodesk

22. Autodesk is a registered trademark of Autodesk, Inc., and/or its subsidiaries and/or affiliates in the USA and/or other countries. All other brand names, product names, or trademarks belong to
their respective holders. Autodesk reserves the right to alter product and services offerings, and specifications and pricing at any time without notice, and is not responsible for typographical or
graphical errors that may appear in this document.
© 2014 Autodesk. All rights reserved.
@alanwill alanwill