Skip to content

Commit bbbd905

Browse files
kcantrelkcantrel
committed
Changed the way secrets are retrieved
1 parent 1f9bd1d commit bbbd905

File tree

4 files changed

+408
-106
lines changed

4 files changed

+408
-106
lines changed

‎Monitoring/ingest_nas_audit_logs_into_cloudwatch/README-MANUAL.md‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -93,16 +93,29 @@ process a lot of audit entries and/or process a lot of SVMs.
9393

9494
3. Configure the Lambda function by setting the following environment variables. For a Lambda function you do this by clicking on the `Configuration` tab and then the `Environment variables` sub tab.
9595

96-
| Variable | Description |
97-
| --- | --- |
98-
| fsxRegion | The region where the FSx for ONTAP file systems are located. |
99-
| secretArn | The ARN of the secret that contains the credentials for all the FSx for ONTAP file systems you want to gather audit logs from. |
100-
| s3BucketRegion | The region of the S3 bucket where the stats file is stored. |
101-
| s3BucketName | The name of the S3 bucket where the stats file is stored. |
102-
| copyToS3 | Set to `true` if you want to copy the raw audit log files to the S3 bucket.|
103-
| statsName | The name you want to use as the stats file. |
104-
| logGroupName | The name of the CloudWatch log group to ingest the audit logs into. |
105-
| volumeName | The name of the volume, on all the FSx for ONTAP file systems, where the audit logs are stored. |
96+
| Variable | Required| Description |
97+
| --- | --- | --- |
98+
| fsxRegion | Yes |The region where the FSx for ONTAP file systems are located. |
99+
| s3BucketRegion |Yes | The region of the S3 bucket where the stats file is stored. |
100+
| s3BucketName | Yes |The name of the S3 bucket where the stats file is stored. |
101+
| copyToS3 | No| Set to `true` if you want to copy the raw audit log files to the S3 bucket.|
102+
|fsxnSecretARNsFile|No|The name of a file within the S3 bucket that contains the Secret ARNs for each for the FSxN file systems. The format of the file should be just `<fsID>=<secretARN>`. For example: `fs-0e8d9172fa5411111=arn:aws:secretsmanager:us-east-1:123456789012:secret:fsxadmin-abc123`|
103+
|fileSystem1ID|No|The ID of the first FSxN file system to ingest the audit logs from.|
104+
|fileSystem1SecretARN|No|The ARN of the secret that contains the credentials for the first FSx for Data ONTAP file system.|
105+
|fileSystem2ID|No|The ID of the second FSx for Data ONTAP file system to ingest the audit logs from.|
106+
|fileSystem2SecretARN|No|The ARN of the secret that contains the credentials for the second FSx for Data ONTAP file system.|
107+
|fileSystem3ID|No|The ID of the third FSx for Data ONTAP file system to ingest the audit logs from.|
108+
|fileSystem3SecretARN|No|The ARN of the secret that contains the credentials for the third FSx for Data ONTAP file system.|
109+
|fileSystem4ID|No|The ID of the forth FSx for Data ONTAP file system to ingest the audit logs from.|
110+
|fileSystem4SecretARN|No|The ARN of the secret that contains the credentials for the forth FSx for Data ONTAP file system.|
111+
|fileSystem5ID|No|The ID of the fifth FSx for Data ONTAP file system to ingest the audit logs from.|
112+
|fileSystem5SecretARN|No|The ARN of the secret that contains the credentials for the fifth FSx for Data ONTAP file system.|
113+
| statsName | Yes| The name you want to use as the stats file. |
114+
| logGroupName | Yes| The name of the CloudWatch log group to ingest the audit logs into. |
115+
| volumeName | Yes| The name of the volume, on all the FSx for ONTAP file systems, where the audit logs are stored. |
116+
117+
**NOTE:** You only need to set the `fsxnSecretARNsFile` or the `fileSystemXID` and `fileSystemXSecretARN` variables.
118+
If both are provide, then the `fsxnSecretARNsFile` will be used and the `fileSystemXID` and `fileSystemXSecretARN` variables will be ignored.
106119

107120
4. Test the Lambda function by clicking on the `Test` tab and then clicking on the `Test` button. You should see "Executing function: succeeded".
108121
If not, click on the "Details" button to see what errors there are.

‎Monitoring/ingest_nas_audit_logs_into_cloudwatch/README.md‎

Lines changed: 21 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ It will maintain a "stats" file in an S3 bucket that will keep track of the last
1010
SVM to try to ensure it doesn't process an audit file more than once.
1111
You can run this script as a standalone program or as a Lambda function. These directions assume you are going to run it as a Lambda function.
1212

13-
**NOTE**: There are two ways to install this program. Either with the [CloudFormaiton script](cloudformation-template.yaml) found this this repo,
13+
**NOTE**: There are two ways to install this program. Either with the [CloudFormation script](cloudformation-template.yaml) found this this repo,
1414
or by following the manual instructions found in the [README-MANUEL.md](README-MANUAL.md) file.
1515

1616
## Prerequisites
@@ -27,17 +27,17 @@ ensure you have set up a rotation schedule. The program will only act on audit l
2727
[knowledge based article](https://kb.netapp.com/on-prem/ontap/da/NAS/NAS-KBs/How_to_set_up_NAS_auditing_in_ONTAP_9) for instructions on how to setup NAS auditing.
2828
- Have the NAS auditing configured to store the audit logs in a volume with the same name in all SVMs on all the FSx for Data ONTAP file
2929
systems that you want to ingest the audit logs from.
30-
- An AWS Secrets Manager secret that contains the credentials for all the FSxNs you want to use to obtain the NAS Audit logs from.
31-
- The secret should be in the form of key/value pairs where the key is the file system ID and value is a dictionary with the keys `username` and `password`. For example:
32-
```json
30+
- An AWS Secrets Manager secret for each of the FSxN file systems you wish to ingest the audit logs from. The secret should have two keys `username` and `password`. For example:
31+
```json
3332
{
34-
"fs-0e8d9172fa5411111": {"username": "fsxadmin", "password": "superSecretPassword"},
35-
"fs-0e8d9172fa5422222": {"username": "service_account", "password": "superSecretPassword"}
33+
"username": "fsxadmin",
34+
"password": "superSecretPassword"
3635
}
37-
```
36+
```
37+
You can use the same secret for multiple file systems if the credentials are the same.
3838
- You have applied the necessary SACLs to the files you want to audit. The knowledge base article linked above provides guidance on how to do this.
3939

40-
**You can either create the following items before running the CloudFormaiton script, or allow it to create the items for you.**
40+
**You can either create the following items before running the CloudFormation script, or allow it to create the items for you.**
4141

4242
- AWS Endpoints. Since the Lambda function runs within your VPC it will not have access to the Internet, even if you can access the Internet
4343
from the Subnet it runs from. Although, if you are using an AWS Transit Gateway, you can configure it to allow the Lambda function to access the Internet.
@@ -96,7 +96,17 @@ and `DeleteNetworkInterface` actions. The correct resource line is `arn:aws:ec2:
9696
|s3BucketName|Yes|The name of the S3 bucket where the stats file is stored. This bucket must already exist.|
9797
|s3BucketRegion|Yes|The region of the S3 bucket resides.|
9898
|copyToS3|No|If set to `true` it will copy the audit logs to the S3 bucket specified in `s3BucketName`.|
99-
|secretArn|Yes|The ARN to the secret that contains the credentials for the FSxN file systems that you want to ingest audit logs from.|
99+
|fsxnSecretARNsFile|No|The name of a file within the S3 bucket that contains the Secret ARNs for each for the FSxN file systems. The format of the file should be just `<fsID>=<secretARN>`. For example: `fs-0e8d9172fa5411111=arn:aws:secretsmanager:us-east-1:123456789012:secret:fsxadmin-abc123`|
100+
|fileSystem1ID|No|The ID of the first FSxN file system to ingest the audit logs from.|
101+
|fileSystem1SecretARN|No|The ARN of the secret that contains the credentials for the first FSx for Data ONTAP file system.|
102+
|fileSystem2ID|No|The ID of the second FSx for Data ONTAP file system to ingest the audit logs from.|
103+
|fileSystem2SecretARN|No|The ARN of the secret that contains the credentials for the second FSx for Data ONTAP file system.|
104+
|fileSystem3ID|No|The ID of the third FSx for Data ONTAP file system to ingest the audit logs from.|
105+
|fileSystem3SecretARN|No|The ARN of the secret that contains the credentials for the third FSx for Data ONTAP file system.|
106+
|fileSystem4ID|No|The ID of the forth FSx for Data ONTAP file system to ingest the audit logs from.|
107+
|fileSystem4SecretARN|No|The ARN of the secret that contains the credentials for the forth FSx for Data ONTAP file system.|
108+
|fileSystem5ID|No|The ID of the fifth FSx for Data ONTAP file system to ingest the audit logs from.|
109+
|fileSystem5SecretARN|No|The ARN of the secret that contains the credentials for the fifth FSx for Data ONTAP file system.|
100110
|createWatchdogAlarm|No|If set to `true` it will create a CloudWatch alarm that will alert you if the Lambda function throws in error.|
101111
|snsTopicArn|No|The ARN of the SNS topic to send the alarm to. This is required if `createWatchdogAlarm` is set to `true`.|
102112
|lambdaRoleArn|No|The ARN of the role that the Lambda function will use. If not provided, the CloudFormation script will create a role for you.|
@@ -109,6 +119,8 @@ and `DeleteNetworkInterface` actions. The correct resource line is `arn:aws:ec2:
109119
|vpcId|No|This is the VPC that the endpoint(s) will be created in. Only needed if you are creating an endpoint.|
110120
|endpointSecurityGroupIds|No|The security group that the endpoint(s) will be associated with. Must allow incoming TCP traffic over port 443. Only needed if you are creating an endpoint.|
111121

122+
**Note**: You must either provide the fsxnSecretARNsFile or the fileSystem1ID, fileSystem1SecretARN, fileSystem2ID, fileSystem2SecretARN, etc. parameters.
123+
112124
6. Click on the `Next` button.
113125
7. The next page will provide for some additional configuration options. You can leave these as the default values.
114126
At the bottom of the page, there is a checkbox that you must check to allow the CloudFormation script to create the

0 commit comments

Comments
 (0)