Add initial configuration for EKS Control Plane logging SIEM integration

Author: zaklawrencea

cluster/cluster.yaml

@@ -166,6 +166,85 @@ Resources:
     Properties:
       LogGroupName: "/aws/eks/{{.Cluster.Name}}/cluster"
       RetentionInDays: 545
+{{- if eq .Cluster.ConfigItems.eks_siem_logging "true" }}
+  EKSControlPlaneSubscriptionFilter:
+    Type: AWS::Logs::SubscriptionFilter
+    Properties:
+      LogGroupName: !Ref ControlPlaneLogGroup
+      RoleArn: !GetAtt EKSControlPlaneCWtoFirehoseRole.Arn
+      FilterName: "EKSCtrlPlaneLogs-{{.Cluster.Name}}"
+      FilterPattern: ""
+      DestinationArn: !GetAtt EKSControlPlaneLogsDataFirehose.Arn
+  EKSControlPlaneLogsDataFirehose:
+    Type: AWS::KinesisFirehose::DeliveryStream
+    Properties:
+      DeliveryStreamName: "EKSCtrlPlaneDeliveryStream-{{.Cluster.Name}}"
+      DeliveryStreamType: DirectPut
+      HttpEndpointDestinationConfiguration:
+        EndpointConfiguration:
+          AccessKey: "{{.Cluster.ConfigItems.eks_siem_key}}"
+          Url: "{{.Cluster.ConfigItems.eks_siem_endpoint}}"
+        RetryOptions:
+          DurationInSeconds: 300
+        S3BackupMode: "FailedDataOnly"
+        S3Configuration:
+          BucketARN: "{{.Cluster.ConfigItems.eks_siem_bucket}}"
+          RoleARN: !GetAtt EKSControlPlaneFirehoseS3Role.Arn
+  EKSControlPlaneFirehoseS3Role:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - firehose.amazonaws.com
+            Action:
+              - 'sts:AssumeRole'
+      Path: /
+      Policies:
+        - PolicyName: root
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - 's3:PutObject'
+                  - 's3:GetObject'
+                  - 's3:ListBucketMultipartUploads'
+                  - 's3:AbortMultipartUpload'
+                  - 's3:ListBucket'
+                  - 's3:GetBucketLocation'
+                Resource:
+                  - "{{.Cluster.ConfigItems.eks_siem_bucket}}"
+      RoleName: "EKSCtrlPlaneFirehosetoS3-{{.Cluster.Name}}"
+  EKSControlPlaneCWtoFirehoseRole:
+    Type: AWS::IAM::Role
+    Properties:
+      AssumeRolePolicyDocument:
+        Version: "2012-10-17"
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service:
+                - "logs.amazonaws.com"
+            Action:
+              - "sts:AssumeRole"
+      Path: /
+      Policies:
+        - PolicyName: root
+          PolicyDocument:
+            Version: "2012-10-17"
+            Statement:
+              - Effect: Allow
+                Action:
+                  - "firehose:PutRecord"
+                  - "firehose:PutRecordBatch"
+                Resource:
+                  - "arn:aws:firehose:*:{{.Cluster.InfrastructureAccountID}}:deliverystream/EKSCtrlPlaneDeliveryStream-{{.Cluster.Name}}"
+      RoleName: "EKSCtrlPlaneCWtoFirehose-{{.Cluster.Name}}"
+{{- end }}
 {{- end }}
   EKSCluster:
     Type: AWS::EKS::Cluster

cluster/config-defaults.yaml

@@ -1331,6 +1331,11 @@ eks_zalando_iam_aws_proxy_hpa_memory_target: "80"
 eks_okta_identity_provider: "true"
 eks_fis_support_enabled: "false"
 
+eks_siem_logging: "false"
+eks_siem_key: ""
+eks_siem_endpoint: ""
+eks_siem_bucket: ""
+
 # prefix delegation can only be configured for ipv4. For ipv6 it can only be true.
 aws_vpc_cni_prefix_delegation: "false"
 # enable custom networking for the AWS VPC CNI. This assumes that a custom CIDR

test/e2e/apply/secret.yaml

@@ -23,5 +23,8 @@ data:
   SKIPPER_OPA_BUCKET_ARN: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwGZdCVDLsCdProfzvZU7UAwAAAAlzCBlAYJKoZIhvcNAQcGoIGGMIGDAgEAMH4GCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMehOf7Uu444SWS6kbAgEQgFFPMaa0flwHLpxrkYjJMK4jXc0q4kX+KGrB5GFjKuUgOUPmQ+ME/aQduxwl2+xUilrKP50/NLXgMNHjeeHuZfoyiSgpGFBM4z8L0N6ggf2uE5U="
   SKIPPER_OPA_OBSERVABILITY_URL: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwHl773AuNEvIpzaM6ycpDNSAAAAqzCBqAYJKoZIhvcNAQcGoIGaMIGXAgEAMIGRBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDGld6jpQ38gOzVcn0gIBEIBkTHbv3adeEfRntVTUQyyQkIhUnc0QXKtmtJEdvBoRzWiJIBKQUQuM1VBV0re3HkO8HSY59nkwyHEncBMkHJoI9rC2LJuWU20oCjPw9lbweih+6Sxo+nqkDrQd+mHp+uA9Om3KqA=="
   SKIPPER_OPA_BUNDLES_URL: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwFnhaIRP4+3Y69xp1ycTI7qAAAAsTCBrgYJKoZIhvcNAQcGoIGgMIGdAgEAMIGXBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDF9gAl70l2g2kwfnJgIBEIBqP/DgIhIu5x5XNR1Ubqinz6r4ttQoHty8nXd6mxie2r6NxHskNOqkiSactUKhNIhboNlNsO4p4rKEkhglTeFZlEQvgEYNioWPw39xqICnUDPVr+Kp0Yrs/bzPLPV9wOlB917UiT7WJNybPg=="
+  EKS_SIEM_KEY: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwF5sFpqE6ok9WBcEvCMM3JjAAAEQDCCBDwGCSqGSIb3DQEHBqCCBC0wggQpAgEAMIIEIgYJKoZIhvcNAQcBMB4GCWCGSAFlAwQBLjARBAz8LolXDRH09jIjmM0CARCAggPz3MQkuDBrEHnPjL7uRfR8uE3OLittRqTa67pPa2z6c4CawFsSdfKrTNjJYsxpFtAzv5Dfr0Nf2He3N0ynIvIZekrXdq+2BgIwkgI+p2D+KMQunFafwKXsTYtyVOy8Qb/0kRJhOlM770/3lT8YgAGtfGTaGEtc6xxRc7bsyodw4IuzdKPuQ4n0ZqsGxQezUaFJB/DW4vqnvOKqZAFrdPr//w4Si1nHn4CStlwOqJRQT8WliG5neFg/VqcwUfV5/El98n8YlBMvrpnwmvW5BQ1TRmydGNyyEMrJr+HNIdutnk6x62GWISMVaye2CW4TAqQY9gW49/FGOMLK86YOxb4ACabmUAxINEKooeGjpqQMBuYjb71aGU1cETpUAcv6prSyTASjur7btoiV6JLdXIU+yBHjCDuJpuIQxwNvdmIgX1TAkT1YZ6GvHogdu/1lv2PGDuKOaO8IWC2k4D8fspWA0yTP/nlsas067czYrdnYsf7c+87wOY5Q/1Yk1qAV6kateiibb+7wwTYpdnHCBoIG6o+VLx/RcIX+yNzYvCZ0fd58G8SPaxWXkLwesjkDR8kKWUB4pPWMLpugZutrNfDjkbsqFMVdG40N/T1LYKzt5x2ROv96QUrHNQ34uqyL77eO1MPRiZ3wLZbX/2VZf6H7qbBG0+0S7timbEBANMMsP3RxIqoMJPTVowkMcZkCm2WWYXGeONyD0vM4a4LSl4pq9iKVseJtdTVXR3u/51XSCj98dho13OKIyEMGvxeEezP1c6VPpMPtxsV8oEeTG86CQVkWetyI4vrLc+5TTrlr/oJsI4B1Fzb6CKkHe5kc8O3KEKGM9EOqAjHECyOtb6GARv+kbIlBuVSV2Olk4ML1tNbQMBz3Sizj71wcvAwxHvaO2FPcVw0rovYg1Gev7m3fC/LFwbJS8rwUzujSL2xxgIII4BKAZE3Jsggi82dkeRY1v2evyR70mkVeFvEZGRgS5ESEw1BcRhmTGo/FCxuVAsw4GNaZssB7PeQlgenO/2eDLbxG/LYw5odrfQ0STSduxlNzNWemIV3mc3uxV5+KJvVxlIEIM/oV4IelWz/qgd2q3Q5/om+U6M9V5utIx38Pi1IxZZN8tHNXTs4QxJwo0v8jh5cnh2XCid9cAMSAubOODizFTODJbw+ziytOkaLqKLnQ/fih24DgcsdBQgNLwVXDDSa1Ps3ud8Pm5E2QQgQ90cB8PyTxkpWnb0AXZbUhOpzmfjVrLYQxCe6hAdLJ/sEgJrCA9YLUyD70/mvjLvfm3l1QvzXhUu7dU76oY+ApF10rTQVkCD3RPLU+D8w1Crl/VwgAS+M4H04Z1rTInJPBJY2u"
+  EKS_SIEM_BUCKET: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwEEmm11rHVhNi6M+ubLnTuUAAAAhzCBhAYJKoZIhvcNAQcGoHcwdQIBADBwBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDIgZskpf9Z0A14HZkgIBEIBD+s3K+UEcI5UzSfzl+5aQUvdoIqUppIgHWCcp+fcog85crXefTXCj27WvnRliczy5oA0Eaf6OcuMI4vR6pjHjAtyDMg=="
+  EKS_SIEM_ENDPOINT: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwEuis70Cw333IRrRwd9b/CqAAAAoTCBngYJKoZIhvcNAQcGoIGQMIGNAgEAMIGHBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDDC8FXyMPkjxBOmThgIBEIBaX9aeXpWUdi1DZHajXN+KwiHtiUF5xDTqhJQlVXnlg3gngYzScKosr2JCHpKjOr6t5cudOlPahAx5Ytj0pp/MV5VbV3TvFNblCwLeUvdFmJqGLMEUcA7ezrUf"
   WIZ_API_CLIENT_ID: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwFn2cC9VUx9oEGR3PjfaODfAAAAljCBkwYJKoZIhvcNAQcGoIGFMIGCAgEAMH0GCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMDj9oNRK5BHCJJuwZAgEQgFC4GWzbjJjUwvzyISqJg9ehVrLApd8RyOYOJH47IEGYsoXvxG1r1sqP36yk+y0rO/F5XPU+p7ShwMmWsEUx3zWuJg94v72u5qvkzmKHVq15oA=="
-  WIZ_API_CLIENT_TOKEN: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwERI9ukj+5n0nNTOn6OQwBWAAAAojCBnwYJKoZIhvcNAQcGoIGRMIGOAgEAMIGIBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDP0Ca5G5Ey/GhZKbqgIBEIBbZQ7luhl1uB5kBEyAX7LevLbqVguwnSXZXWLR/morkrnMnylHHE1sVSedW94WpIF5qxh0eE/fsVJWErYcwhPqd3UvaPG9LSeXyBwo2RNLkYYdrnY4DmvxIvoLjw=="
+  WIZ_API_CLIENT_TOKEN: "deployment-secret:2:stups-test:AQICAHjXIrc66g/+P4X1Gl4MKcInWmwpFxivAqFGMI0fr9DvCwERI9ukj+5n0nNTOn6OQwBWAAAAojCBnwYJKoZIhvcNAQcGoIGRMIGOAgEAMIGIBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDP0Ca5G5Ey/GhZKbqgIBEIBbZQ7luhl1uB5kBEyAX7LevLbqVguwnSXZXWLR/morkrnMnylHHE1sVSedW94WpIF5qxh0eE/fsVJWErYcwhPqd3UvaPG9LSeXyBwo2RNLkYYdrnY4DmvxIvoLjw=="

test/e2e/cluster_config.sh

@@ -51,6 +51,10 @@ clusters:
     skipper_open_policy_agent_observability_url: "${SKIPPER_OPA_OBSERVABILITY_URL}"
     skipper_open_policy_agent_bundles_url: "${SKIPPER_OPA_BUNDLES_URL}"
     eks_ip_family: "ipv6"
+    eks_siem_logging: "true"
+    eks_siem_key: "${EKS_SIEM_KEY}"
+    eks_siem_endpoint: "${EKS_SIEM_ENDPOINT}"
+    eks_siem_bucket: "${EKS_SIEM_BUCKET}"
     consolidation_policy: "WhenEmpty"
     consolidate_after: "5m"
     wiz_api_client_id: "${WIZ_API_CLIENT_ID}"