Configure HCP Vault audit logs streaming to Amazon CloudWatch
This tutorial covers configuration of HCP Vault audit logs streaming to your existing Amazon CloudWatch environment.
Availability
HCP Vault audit logs streaming is available for all production grade clusters. The feature is not available for Development tier clusters.
Prerequisites
To configure audit logs streaming to Amazon CloudWatch, you will need to have:
A HCP account with Admin or Contributor role assigned in HCP
A production grade HCP Vault cluster
Access to AWS with permission to create IAM policies and users
Note
If you don't have a cluster running, refer to the Create a Vault Cluster on HCP tutorial to create an HCP Vault cluster through HCP Portal. Or, refer to the Deploy HCP Vault with Terraform tutorial to provision an HCP Vault cluster using Terraform.
Configure AWS
To configure HCP Vault audit log streaming to Amazon CloudWatch, you must provide an access and secret key for an IAM user assigned permission to CloudWatch.
Create IAM policy
Log in to the AWS Management Console and navigate to the IAM Dashboard.
Click Policies, then click Create policy.
Click the JSON tab and paste the IAM policy into the Policy editor textbox overwriting any sample text.
Click Next.
Enter
hcp-vault-log-streaming
in the Policy name textbox and click Create policy.
Create IAM user
From the IAM Dashboard, click Users.
Click Add users.
Enter
hcp-vault-log-streaming
in the User name textbox and click Next.Click the Attach policies directly radio button.
Search for the
hcp-vault-log-streaming
policy, click the checkbox, and click Next.Note
This tutorial has you attach the policy directly to the IAM user for ease of completing the tutorial.
The recommended practice is to create an IAM group, attach the policy to the group, and add the user to the group.
Click Create user.
Click the hcp-vault-log-streaming user in the Users list.
Click the Security credentials tab and click Create access key.
Select Application running outside AWS and click Next.
Click Create access key.
Securely store the Access key and Secret access key values - you will need this to configure audit log streaming in the HCP Portal.
Enable audit logs streaming
Log in to the HCP Portal and navigate to the Vault clusters page.
Click the Vault cluster you wish to enable streaming for and click Audit Logs.
Click Enable log Streaming.
From the Enable audit logs streaming view, select Amazon CloudWatch as the provider and click Next.
Under Add provider details, enter the Access key ID and Secret access key created in the Create IAM user section, then select the Region that matches your existing CloudWatch environment.
Click Save.
Note
At this time, HCP Vault only supports audit logs streaming to one log endpoint at a time.
Refer to the CloudWatch documentation for details on log exploration.
Edit the audit log streaming configuration
To edit a audit log streaming integration, perform the following steps.
From the Audit Logs page, click on the Manage drop-down, then Edit configuration.
Edit the configuration, then click Save.
Disable audit log streaming
To disable a audit log streaming integration, from the Audit Logs page, click on the Manage drop-down, then Disable streaming.