Cis AWS Compute 10.2

10.2 Ensure Persistent logs is setup and configured to S3 (Manual)

Description

Elastic Beanstalk can be configured to automatically stream logs to the CloudWatch service.

Rationale

With CloudWatch Logs, you can monitor and archive your Elastic Beanstalk application, system, and custom log files from Amazon EC2 instances of your environments.

Impact

N/A

Audit Procedure

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to review
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Softwares
7. Confirm Log streaming: enabled
8. If status options reads Log streaming: disabled refer to the remediation below.
9. Repeat steps 3-8 for each environment within the current region.
10. Then repeat the Audit process for all other regions.

Using AWS CLI

N/A - This control is manual and console-based.

Expected Result

Log streaming: enabled is displayed under the Softwares category in the environment Configuration.

Remediation

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to update
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Software
7. Click on Edit
8. On the Modify software page:

Instance log streaming to CloudWatch Logs
Log streaming - click the Enabled checkbox
Set the required retention based on Organization requirements
Lifecycle - Keep logs after terminating environment

9. Click Apply
10. Repeat steps 3-8 for each environment within the current region that needs Managed updates set.

Using AWS CLI

N/A - This control is manual and console-based.

Default Value

Log streaming to CloudWatch is not enabled by default.

References

1. https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html

CIS Controls

Profile

Level 1 | Manual