Introduction
GitHub Enterprise Cloud audit logs support log streaming to various cloud providers.
Streaming audit logs to Amazon S3 can be done via OpenID Connect. This requires the creation of an OIDC Provider and IAM role on the AWS side and an S3 bucket for log storage.
Please refer to the above document for detailed instructions.
It is not something that is created many times, but I have created a CloudFormation template and hope it will be helpful for those who want to create a new one quickly and easily.
Resources to be created
| Logical ID | Type | Description |
|---|---|---|
| AuditLogBucket | AWS::S3::Bucket | S3 bucket for audit log |
| AuditLogbucketPolicy | AWS::S3::BucketPolicy | S3 bucket policy for audit log |
| AccessLogBucket | AWS::S3::Bucket | S3 bucket for server access log |
| AccessLogBucketPolicy | AWS::S3::BucketPolicy | S3 bucket policy for server access log |
| AuditLogEncryptionKey | AWS::KMS::Key | Customer Managed Key for audit log encryption |
| AuditLogEncryptionKeyAlias | AWS::KMS::Alias | Customer Managed Key alias |
| AuditLogStremingPolicy | AWS::IAM::ManagedPolicy | IAM policy for audit log streaming |
| AuditLogStreamingRole | AWS::IAM::Role | IAM Role for audit log streaming |
| GithubAuditLogOIDCProvider | AWS::IAM::OIDCProvider | GitHub OIDC provider |
CloudFormation template
Github repository is here
CFn-github-audit-log-streaming
This CloudFormation template creates the AWS resources required for GitHub Enterprise Cloud audit log streaming.
AWSTemplateFormatVersion: "2010-09-09"
Description: Create AWS resources required for GitHub Enterprise Cloud audit log streaming
Parameters:
RetainDays:
Description: Number of days to keep audit log.
Type: String
Default: 365
EnterpriseName:
Description: Your GitHub Enterprise Name.
Type: String
Default: EXAPMLECORP
AccessLogPrefix:
Description: Server access log-prefix of audit log bucket.
Type: String
Default: logs/
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: GitHub Configuration
Parameters:
- EnterpriseName
- Label:
default: Audit Log Configuration
Parameters:
- RetainDays
- AccessLogPrefix
Resources:
# Customer Managed Key for audit log encryption
AuditLogEncryptionKey:
Type: AWS::KMS::Key
Properties:
Description: Customer Managed Key for audit log encryption
Enabled: true
EnableKeyRotation: True
KeyPolicy:
Version: '2012-10-17'
Id: key-default-1
Statement:
- Sid: Allow administration of the key
Effect: Allow
Principal:
AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
Action:
- kms:Create*
- kms:Describe*
- kms:Enable*
- kms:List*
- kms:Put*
- kms:Update*
- kms:Revoke*
- kms:Disable*
- kms:Get*
- kms:Delete*
- kms:ScheduleKeyDeletion
- kms:CancelKeyDeletion
Resource: '*'
- Sid: Allow local use of the key
Effect: Allow
Principal:
AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
Action:
- kms:Encrypt
- kms:Decrypt
- kms:ReEncrypt*
- kms:GenerateDataKey*
- kms:DescribeKey
Resource: '*'
# Customer Managed Key ALias
AuditLogEncryptionKeyAlias:
Type: AWS::KMS::Alias
Properties:
AliasName: !Sub alias/${AWS::StackName}-key
TargetKeyId: !Ref AuditLogEncryptionKey
# S3 bucket for audit log
AuditLogBucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: aws:kms
KMSMasterKeyID: !GetAtt AuditLogEncryptionKey.Arn
BucketKeyEnabled: true
LifecycleConfiguration:
Rules:
- Id: Retain
Status: Enabled
ExpirationInDays: !Ref RetainDays
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
LoggingConfiguration:
DestinationBucketName: !Ref AccessLogBucket
LogFilePrefix: !Ref AccessLogPrefix
VersioningConfiguration:
Status: Enabled
OwnershipControls:
Rules:
- ObjectOwnership: BucketOwnerEnforced
# S3 bucket policy for audit log
AudtiLogBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref AuditLogBucket
PolicyDocument:
Statement:
- Effect: Deny
Principal: '*'
Action: 's3:*'
Resource:
- !Sub ${AuditLogBucket.Arn}/*
- !GetAtt AuditLogBucket.Arn
Condition:
Bool:
aws:SecureTransport: false
# S3 bucket for server access log
AccessLogBucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: AES256
LifecycleConfiguration:
Rules:
- Id: Retain
Status: Enabled
ExpirationInDays: !Ref RetainDays
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
VersioningConfiguration:
Status: Enabled
OwnershipControls:
Rules:
- ObjectOwnership: BucketOwnerEnforced
# S3 bucket policy for server access log
AccessLogBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref AccessLogBucket
PolicyDocument:
Statement:
- Effect: Deny
Principal: '*'
Action: 's3:*'
Resource:
- !Sub ${AccessLogBucket.Arn}/*
- !GetAtt AccessLogBucket.Arn
Condition:
Bool:
aws:SecureTransport: false
- Effect: Allow
Principal:
Service: logging.s3.amazonaws.com
Action: s3:PutObject
Resource:
- !Sub ${AccessLogBucket.Arn}/${AccessLogPrefix}*
Condition:
ArnLike:
aws:SourceArn: !GetAtt AuditLogBucket.Arn
StringEquals:
aws:SourceAccount: !Ref AWS::AccountId
# IAM policy for audit log streaming role
AuditLogStremingPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Description: Policy for GitHub Audit Log Streaming
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- s3:PutObject
Resource:
- !Sub ${AuditLogBucket.Arn}/*
# IAM Role for audit log streaming role
AuditLogStreamingRole:
Type: AWS::IAM::Role
Properties:
ManagedPolicyArns:
- !Ref AuditLogStremingPolicy
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Action: sts:AssumeRoleWithWebIdentity
Principal:
Federated: !Ref GithubAuditLogOIDCProvider
Condition:
StringEquals:
oidc-configuration.audit-log.githubusercontent.com:sub: !Sub https://github.com/${EnterpriseName}
oidc-configuration.audit-log.githubusercontent.com:aud: sts.amazonaws.com
GithubAuditLogOIDCProvider:
Type: AWS::IAM::OIDCProvider
Properties:
Url: https://oidc-configuration.audit-log.githubusercontent.com
ClientIdList:
- sts.amazonaws.com
ThumbprintList:
- 7e6db7b7584d8cf2003e0931e6cfc41a3a62d3df
Outputs:
IAMRole:
Description: IAM role for audit log streaming role
Value: !GetAtt AuditLogStreamingRole.Arn
AuditLogBucket:
Description: S3 bucket for audit log
Value: !Ref AuditLogBucket
Deploy
3 parameters are required.
GitHub Enterprise Name (
EnterpriseName)Number of days to keep audit log (
RetainDays)Server access log-prefix of audit log bucket (
AccessLogPrefix)
After deploying the stack, set the output S3 bucket name and IAM Role ARN to GitHub Enterprise Cloud.
If the endpoint connection check is successful, save the configuration.
You can see the audit log in the AuditLogBucket!
I hope this will be of help to someone else.
Top comments (0)