|
| 1 | +# Ingest FSx for ONTAP NAS audit logs into CloudWatch |
| 2 | + |
| 3 | +## Overview |
| 4 | +This sample demonstrates a way to ingest the NAS audit logs from an FSx for Data ONTAP file system into a CloudWatch log group |
| 5 | +without having to NFS or CIFS mount a volume to access them. |
| 6 | +It will attempt to gather the audit logs from all the SVMs within all the FSx for Data ONTAP file systems that are within a specified region. |
| 7 | +It will skip any file systems where the credentials aren't provided in the supplied AWS SecretManager's secret, or that do not have |
| 8 | +the appropriate NAS auditing configuration enabled. |
| 9 | +It will maintain a "stats" file in an S3 bucket that will keep track of the last time it successfully ingested audit logs from each |
| 10 | +SVM to try to ensure it doesn't process an audit file more than once. |
| 11 | +You can run this script as a standalone program or as a Lambda function. These directions assume you are going to run it as a Lambda function. |
| 12 | +**NOTE**: There are two ways to install this program. Either with the [CloudFormaiton script](cloudformation-template.yaml) found this this repo, |
| 13 | +or by following the manual instructions found in the this file. |
| 14 | + |
| 15 | +## Prerequisites |
| 16 | +- An FSx for Data ONTAP file system. |
| 17 | +- An S3 bucket to store the "stats" file and a Lambda layer zip file. |
| 18 | + - You will need to download the [Lambda layer zip file](https://raw.githubusercontent.com/NetApp/FSx-ONTAP-samples-scripts/main/Monitoring/ingest_nas_audit_logs_into_cloudwatch/lambda_layer.zip) from this repo and upload it to the S3 bucket. Be sure to perserve the name `lambda_layer.zip`. |
| 19 | + - The "stats" file is maintained by the program. It is used to keep track of the last time the Lambda function successfully ingested audit logs from each SVM. Its size will be small (i.e. less than a few megabytes). |
| 20 | +- A CloudWatch log group to ingest the audit logs into. Each audit log file with get its own log stream within the log group. |
| 21 | +- Have NAS auditing configured and enabled on the SVM within a FSx for Data ONTAP file system. **Ensure you have selected the XML format for the audit logs.** Also, |
| 22 | +ensure you have set up a rotation schedule. The program will only act on audit log files that have been finalized, and not the "active" one. You can read this |
| 23 | +[knowledge based article](https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-KBs/How_to_set_up_NAS_auditing_in_ONTAP_9) for instructions on how to setup NAS auditing. |
| 24 | +- Have the NAS auditing configured to store the audit logs in a volume with the same name in all SVMs on all the FSx for Data ONTAP file |
| 25 | +systems that you want to ingest the audit logs from. |
| 26 | +- An AWS Secrets Manager secret that contains the credentials you want to use to obtain the NAS Audit logs with for all the FSxN file systems. |
| 27 | + - The secret should be in the form of key/value pairs where the key is the file system ID and value is a dictionary with the keys `username` and `password`. For example: |
| 28 | +```json |
| 29 | + { |
| 30 | + "fs-0e8d9172fa5411111": {"username": "fsxadmin", "password": "superSecretPassword"}, |
| 31 | + "fs-0e8d9172fa5422222": {"username": "service_account", "password": "superSecretPassword"} |
| 32 | + } |
| 33 | +``` |
| 34 | +- You have applied the necessary SACLs to the files you want to audit. The knowledge base article linked above provides guidance on how to do this. |
| 35 | + |
| 36 | +- AWS Endpoints. Since the Lambda function runs within your VPC it will not have access to the Internet, even if you can access the Internet from the Subnet it runs from. |
| 37 | +Therefore, there needs to be an VPC endpoint for all the AWS services that the Lambda function uses. Specifically, the Lambda function needs to be able to access the following AWS services: |
| 38 | + - FSx. |
| 39 | + - Secrets Manager. |
| 40 | + - CloudWatch Logs. |
| 41 | + - S3 - Note that typically there is a Gateway type VPC endpoint for S3, so you should not need to create a VPC endpoint for S3. |
| 42 | +- Role for the Lambda function. Create a role with the necessary permissions to allow the Lambda function to do the following: |
| 43 | + |
| 44 | +<!--- Using HTML to create a table that has rowspan attributes since the markdown table syntax does not support that. ---> |
| 45 | +<table> |
| 46 | +<tr><th>Service</td><th>Actions</td><th>Resources</th></tr> |
| 47 | +<tr><td>Fsx</td><td>fsx:DescribeFileSystems</td><td>*</td></tr> |
| 48 | +<tr><td rowspan="3">ec2</td><td>DescribeNetworkInterfaces</td><td>*</td></tr> |
| 49 | +<tr><td>CreateNetworkInterface</td><td rowspan="2">arn:aws:ec2:<region>:<accountID>:*</td></tr> |
| 50 | +<tr><td>DeleteNetworkInterface</td></tr> |
| 51 | +<tr><td rowspan="3">CloudWatch Logs</td><td>CreateLogGroup</td><td rowspan="3">arn:aws:logs:<region>:<accountID>:log-group:*</td></tr> |
| 52 | +<tr><td>CreateLogStream</td></tr> |
| 53 | +<tr><td>PutLogEvents</td></tr> |
| 54 | +<tr><td rowspan="3">s3</td><td> ListBucket</td><td> arn:aws:s3:<region>:<accountID>:*</td></tr> |
| 55 | +<tr><td>GetObject</td><td rowspan="2">arn:aws:s3:<region>:<accountID>:*/*</td></tr> |
| 56 | +<tr><td>PutObject</td></tr> |
| 57 | +<tr><td>Secrets Manager</td><td> GetSecretValue </td><td>arn:aws:secretsmanager:<region>:<accountID>:secret:<secretName>*</td></tr> |
| 58 | +</table> |
| 59 | +Where: |
| 60 | + |
| 61 | +- <accountID> - is your AWS account ID. |
| 62 | +- <region> - is the region where the FSx for ONTAP file systems are located. |
| 63 | +- <secretName> - is the name of the secret that contains the credentials for the fsxadmin accounts. |
| 64 | + |
| 65 | +Notes: |
| 66 | +- Since the Lambda function runs within your VPC it needs to be able to create and delete network interfaces. |
| 67 | +- The AWS Security Group Policy builder incorrectly generates resource lines for the `CreateNetworkInterface` |
| 68 | +and `DeleteNetworkInterface` actions. The correct resource line is `arn:aws:ec2:<region>:<accountID>:*`. |
| 69 | +- It needs to be able to create a log groups so it can create a log group for the diagnostic output from the Lambda function. |
| 70 | +- Since the ARN of any Secrets Manager secret has random characters at the end of it, you must add the `*` at the end, or provide the full ARN of the secret. |
| 71 | + |
| 72 | +## Deployment |
| 73 | +1. Create a Lambda deployment package by: |
| 74 | + 1. Downloading the [ingest_nas_audit_logs.py](ingest_nas_audit_logs.py) file from this repository and placing it in an empty directory. |
| 75 | + 1. Rename the file to `lambda_function.py`. |
| 76 | + 1. Install a couple dependencies that aren't included with AWS's base Lambda runtime by executing the following command:<br> |
| 77 | +`pip install --target . xmltodict requests_toolbelt`<br> |
| 78 | + 1. Zip the contents of the directory into a zip file.<br> |
| 79 | +`zip -r ingest_nas_audit_logs.zip .`<br> |
| 80 | + |
| 81 | +2. Within the AWS console, or using the AWS API, create a Lambda function with: |
| 82 | + 1. Python 3.10, or higher, as the runtime. |
| 83 | + 1. Set the permissions to the role created above. |
| 84 | + 1. Under `Additional Configurations` select `Enable VPC` and select a VPC and Subnet that will have access to all the FSx for ONTAP |
| 85 | +file system management endpoints that you want to gather audit logs from. Also, select a Security Group that allows TCP port 443 outbound. |
| 86 | +Inbound rules don't matter since the Lambda function is not accessible from a network. |
| 87 | + 1. Click `Create Function` and on the next page, under the `Code` tab, select `Upload From -> .zip file.` Provide the .zip file created by the steps above. |
| 88 | + 1. From the `Configuration -> General` tab set the timeout to at least 30 seconds. You will may need to increase that if it has to |
| 89 | +process a lot of audit entries and/or process a lot of SVMs. |
| 90 | + |
| 91 | +3. Configure the Lambda function by setting the following environment variables. For a Lambda function you do this by clicking on the `Configuration` tab and then the `Environment variables` sub tab. |
| 92 | + |
| 93 | +| Variable | Description | |
| 94 | +| --- | --- | |
| 95 | +| fsxRegion | The region where the FSx for ONTAP file systems are located. | |
| 96 | +| secretArn | The ARN of the secret that contains the credentials for all the FSx for ONTAP file systems you want to gather audit logs from. | |
| 97 | +| s3BucketRegion | The region of the S3 bucket where the stats file is stored. | |
| 98 | +| s3BucketName | The name of the S3 bucket where the stats file is stored. | |
| 99 | +| statsName | The name you want to use as the stats file. | |
| 100 | +| logGroupName | The name of the CloudWatch log group to ingest the audit logs into. | |
| 101 | +| volumeName | The name of the volume, on all the FSx for ONTAP file systems, where the audit logs are stored. | |
| 102 | + |
| 103 | +4. Test the Lambda function by clicking on the `Test` tab and then clicking on the `Test` button. You should see "Executing function: succeeded". |
| 104 | +If not, click on the "Details" button to see what errors there are. |
| 105 | + |
| 106 | +5. After you have tested that the Lambda function is running correctly, add an EventBridge trigger to have it run periodically. |
| 107 | +You can do this by clicking on the `Add Trigger` button within the AWS console on the Lambda page and selecting `EventBridge (CloudWatch Events)` |
| 108 | +from the drop-down menu. You can then configure the schedule to run as often as you want. How often depends on how often you have |
| 109 | +set up your FSx for ONTAP file systems to rotate audit logs, and how up-to-date you want the CloudWatch logs to be. |
| 110 | + |
| 111 | +## Author Information |
| 112 | + |
| 113 | +This repository is maintained by the contributors listed on [GitHub](https://github.com/NetApp/FSx-ONTAP-samples-scripts/graphs/contributors). |
| 114 | + |
| 115 | +## License |
| 116 | + |
| 117 | +Licensed under the Apache License, Version 2.0 (the "License"). |
| 118 | + |
| 119 | +You may obtain a copy of the License at [apache.org/licenses/LICENSE-2.0](http://www.apache.org/licenses/LICENSE-2.0). |
| 120 | + |
| 121 | +Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an _"AS IS"_ basis, without WARRANTIES or conditions of any kind, either express or implied. |
| 122 | + |
| 123 | +See the License for the specific language governing permissions and limitations under the License. |
| 124 | + |
| 125 | +© 2024 NetApp, Inc. All Rights Reserved. |
0 commit comments