TDCTF Academy Logo TDCTF ACADEMY
@farishhz

9.5.1 Cloud Logging

Cloud Logging adalah praktik sentralisasi log dari seluruh layanan cloud - compute, network, storage, database, hingga API calls - ke satu platform untuk keperluan audit, forensik, deteksi ancaman, dan compliance. Di lingkungan cloud-native, setiap tindakan pengguna, API call, dan perubahan infrastruktur harus tercatat secara immutable dan tamper-proof.

Arsitektur Centralized Logging

Centralized logging di cloud mengikuti arsitektur log pipeline dengan tiga tahap utama:

  1. Generation - Layanan cloud menghasilkan log (API calls, metrics, events)
  2. Aggregation - Log dikirim ke sentral storage (S3, Azure Blob, GCS) atau SIEM
  3. Analysis & Alerting - Log diproses, dianalisis, dan dijadikan dasar alert
flowchart LR
    subgraph Sumber
        A[AWS EC2 / Lambda]
        B[Azure VM / Functions]
        C[GCP Compute / Cloud Run]
    end
    subgraph Aggregator
        D[CloudWatch Logs / S3]
        E[Azure Monitor Logs]
        F[GCP Cloud Logging]
    end
    subgraph SIEM
        G[Splunk / ELK / Wazuh]
    end
    A --> D
    B --> E
    C --> F
    D --> G
    E --> G
    F --> G

AWS CloudTrail - Audit Trail untuk AWS API

AWS CloudTrail mencatat setiap API call yang dilakukan terhadap AWS infrastructure - baik dari AWS Management Console, AWS CLI, SDK, maupun API langsung.

CloudTrail Event Types

Tipe Event Deskripsi Contoh
Management Events Operasi terhadap resource AWS CreateVpc, DeleteBucket, AttachRolePolicy
Data Events Operasi di dalam resource GetObject di S3, Invoke di Lambda
Insights Events Deteksi aktivitas abnormal IAM user call rate anomali

Konfigurasi CloudTrail Trail

# Membuat trail dengan bucket tujuan
aws cloudtrail create-trail \
    --name production-audit-trail \
    --s3-bucket-name my-audit-logs-bucket \
    --is-multi-region-trail \
    --enable-log-file-validation \
    --kms-key-id alias/cloudtrail-key

# Mengaktifkan log file validation (SHA-256)
aws cloudtrail update-trail \
    --name production-audit-trail \
    --enable-log-file-validation

# Mengaktifkan Insights untuk deteksi anomali
aws cloudtrail put-insight-selectors \
    --trail-name production-audit-trail \
    --insight-selectors '[{"InsightType": "ApiCallRateInsight"}]'

Log File Validation

CloudTrail secara opsional menandatangani setiap log file dengan SHA-256 hashing dan RSA signing menggunakan kunci publik AWS. Ini memastikan integritas log - tidak ada yang bisa mengubah log tanpa terdeteksi.

# Validasi digest file secara manual
aws cloudtrail validate-logs \
    --trail-arn arn:aws:cloudtrail:ap-southeast-1:123456789012:trail/production-audit-trail \
    --start-time 2026-07-20T00:00:00Z \
    --end-time 2026-07-21T00:00:00Z

CloudTrail Lake

CloudTrail Lake menyediakan SQL-based query tanpa perlu menunggu log masuk ke S3:

-- Mencari semua aktivitas DeleteBucket dalam 7 hari terakhir
SELECT eventSource, eventName, userIdentity.arn, sourceIPAddress
FROM cloudtrail_logs
WHERE eventName LIKE 'Delete%'
  AND eventTime > '2026-07-15 00:00:00'
ORDER BY eventTime DESC

Azure Monitor Logs - Log Analytics Workspace

Azure Monitor Logs menggunakan Log Analytics Workspace sebagai repositori sentral untuk log dari Azure resources, on-premise servers, dan aplikasi.

Membuat Log Analytics Workspace

# Azure CLI
az monitor log-analytics workspace create \
    --resource-group security-rg \
    --workspace-name security-audit-workspace \
    --location southeastasia \
    --sku PerGB2018

# Mengirim log dari resources ke workspace
az monitor diagnostic-settings create \
    --resource /subscriptions/xxx/resourceGroups/prod-rg/providers/Microsoft.Network/networkSecurityGroups/prod-nsg \
    --name nsg-audit-diagnostics \
    --workspace security-audit-workspace \
    --logs '[{"category": "NetworkSecurityGroupRuleCounter", "enabled": true}]'

Kusto Query Language (KQL) untuk Threat Hunting

KQL adalah bahasa query utama di Azure Monitor Logs:

// Mendeteksi multiple failed login di VM
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == "50057"  // User account is disabled
| summarize FailedAttempts = count() by UserPrincipalName, IPAddress
| where FailedAttempts > 5
| project UserPrincipalName, IPAddress, FailedAttempts

// Audit perubahan di Azure Policy
AzureActivity
| where OperationName contains "policy"
| where ActivityStatus == "Succeeded"
| project TimeGenerated, Caller, OperationName, Resource

GCP Cloud Logging - Log Router & Logs Explorer

GCP Cloud Logging menggunakan Log Router untuk mengatur aliran log ke berbagai tujuan termasuk BigQuery, Cloud Storage, dan Pub/Sub.

Konfigurasi Log Sink ke BigQuery

# Buat dataset BigQuery untuk log audit
bq mk --dataset my_project:audit_logs

# Buat log sink yang mengirimkan semua log Admin Activity
gcloud logging sinks create admin-activity-sink \
    bigquery.googleapis.com/projects/my_project/datasets/audit_logs \
    --log-filter="LOG_ID(\"cloudaudit.googleapis.com/activity\")" \
    --description="Sink untuk audit admin activity"

# Mengirim log ke Pub/Sub untuk SIEM real-time
gcloud logging sinks create realtime-siem-sink \
    pubsub.googleapis.com/projects/my_project/topics/siem-logs \
    --log-filter="severity>=WARNING"

Jenis Log Audit di GCP

Jenis Log Deskripsi Retention Default
Admin Activity Operasi administratif (create/modify/delete resource) 400 hari
Data Access Operasi baca/tulis data user 400 hari (jika diaktifkan)
System Event Tindakan non-manusia oleh GCP 400 hari
Policy Denied Log akses yang ditolak IAM policy 400 hari

Log Retention Policies

Setiap cloud provider memiliki kebijakan retensi yang berbeda. Best practice adalah menyimpan log sesuai kebutuhan compliance (misalnya PCI DSS mewajibkan 1 tahun, SOC 2 minimal 6 bulan).

AWS - S3 Lifecycle + Object Lock

# Lifecycle policy untuk log S3
aws s3api put-bucket-lifecycle-configuration \
    --bucket my-audit-logs-bucket \
    --lifecycle-configuration '{
        "Rules": [
            {
                "Id": "LogRetention",
                "Status": "Enabled",
                "Filter": {"Prefix": "AWSLogs/"},
                "Transitions": [
                    {"Days": 30, "StorageClass": "STANDARD_IA"},
                    {"Days": 90, "StorageClass": "GLACIER"}
                ],
                "Expiration": {"Days": 365}
            }
        ]
    }'

# S3 Object Lock - immutability untuk compliance
aws s3api put-object-lock-configuration \
    --bucket my-audit-logs-bucket \
    --object-lock-configuration '{
        "ObjectLockEnabled": "Enabled",
        "Rule": {
            "DefaultRetention": {
                "Mode": "GOVERNANCE",
                "Days": 365
            }
        }
    }'

Azure - Data Retention di Log Analytics

# Set retention policy di workspace
az monitor log-analytics workspace update \
    --resource-group security-rg \
    --workspace-name security-audit-workspace \
    --retention-time 365  # dalam hari

GCP - Retention di Log Bucket

# Create a custom log bucket dengan retention 1 tahun
gcloud logging buckets create security-log-bucket \
    --location=global \
    --retention-days=365 \
    --description="Audit log bucket with 1 year retention"

Log Encryption - Enkripsi Log at Rest

Semua log harus dienkripsi at rest dan in transit:

AWS CloudTrail + KMS

# Buat KMS key untuk CloudTrail
aws kms create-key --description "CloudTrail Log Encryption Key"

# Aktifkan SSE-KMS di trail
aws cloudtrail update-trail \
    --name production-audit-trail \
    --kms-key-id arn:aws:kms:ap-southeast-1:123456789012:key/xxxxx-xxxx-xxxx-xxxx-xxxxxxxx

Azure - CMK untuk Log Analytics

Azure Log Analytics mendukung Customer-Managed Keys (CMK) melalui Azure Key Vault:

# Assign managed identity ke workspace
az monitor log-analytics workspace update \
    --resource-group security-rg \
    --workspace-name security-audit-workspace \
    --type SystemAssigned

# Enkripsi workspace dengan customer key
az monitor log-analytics workspace update \
    --resource-group security-rg \
    --workspace-name security-audit-workspace \
    --key-vault-uri https://myvault.vault.azure.net/keys/logkey

Cross-Account Log Aggregation

Di organisasi dengan banyak akun (multi-account AWS, multiple subscriptions Azure), log harus diagregasi ke satu akun sentral.

AWS - Centralized Logging dengan Organization Trail

# Buat Organization Trail dari management account
aws cloudtrail create-trail \
    --name org-audit-trail \
    --s3-bucket-name central-audit-logs-123456789012 \
    --is-organization-trail \
    --enable-log-file-validation

# S3 Bucket Policy - izinkan member account menulis log
aws s3api put-bucket-policy \
    --bucket central-audit-logs-123456789012 \
    --policy '{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::central-audit-logs-123456789012/AWSLogs/*/CloudTrail/*",
                "Condition": {
                    "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}
                }
            }
        ]
    }'

Azure - Cross-Subscription Diagnostic Settings

# Diagnostic setting mengirim log ke Log Analytics Workspace sentral
resource "azurerm_monitor_diagnostic_setting" "cross_sub" {
  name               = "central-audit"
  target_resource_id = azurerm_key_vault.prod.id
  log_analytics_workspace_id = data.azurerm_log_analytics_workspace.central.id

  log {
    category = "AuditEvent"
    enabled  = true
    retention_policy {
      days    = 365
      enabled = true
    }
  }
}

SIEM Integration

SIEM (Security Information and Event Management) adalah platform yang mengkorelasi log dari berbagai sumber untuk mendeteksi ancaman.

1. Splunk - Integration dengan AWS CloudTrail

# Splunk HTTP Event Collector (HEC) - kirim log dari Lambda
curl -k https://splunk.internal:8088/services/collector \
    -H "Authorization: Splunk xxxxx-xxxx-xxxx-xxxx-xxxxxxxx" \
    -d '{
        "event": {
            "source": "cloudtrail",
            "eventName": "CreateUser",
            "userIdentity": "arn:aws:iam::123456789012:user/admin",
            "sourceIPAddress": "203.0.113.42"
        },
        "sourcetype": "aws:cloudtrail"
    }'

2. ELK Stack (Elasticsearch + Logstash + Kibana)

Logstash configuration untuk membaca CloudTrail dari S3:

# /etc/logstash/conf.d/cloudtrail.conf
input {
  s3 {
    bucket => "central-audit-logs-123456789012"
    region => "ap-southeast-1"
    prefix => "AWSLogs/123456789012/CloudTrail/"
    type => "cloudtrail"
    codec => "json"
  }
}

filter {
  json {
    source => "message"
  }
  date {
    match => [ "eventTime", "ISO8601" ]
  }
}

output {
  elasticsearch {
    hosts => ["https://elastic.internal:9200"]
    index => "cloudtrail-%{+YYYY.MM.dd}"
    user => "logstash"
    password => "${ELASTIC_PASSWORD}"
  }
}

3. Wazuh - Open Source SIEM

Wazuh dapat menerima log dari AWS via S3 bucket integration:

# Konfigurasi Wazuh Agent untuk membaca CloudTrail
echo '[cloudtrail]
enabled=yes
bucket=arn:aws:s3:::central-audit-logs-123456789012
interval=10m
run_on_start=yes' > /var/ossec/etc/shared/cloudtrail.conf

CloudTrail Insights - Deteksi Aktivitas Abnormal

CloudTrail Insights secara otomatis mendeteksi pola aktivitas abnormal menggunakan machine learning:

// Contoh Insights Event - API call rate anomaly
{
  "eventVersion": "1.08",
  "insightDetails": {
    "insightType": "ApiCallRateInsight",
    "insightDuration": 1800,
    "baselineAverage": 2.5,
    "insightAverage": 47.3,
    "insightEndTime": "2026-07-20T14:30:00Z",
    "insightStartTime": "2026-07-20T14:00:00Z",
    "insightValue": 44.8,
    "baselineValue": 2.5,
    "insightSeverity": "HIGH",
    "associatedEventsSummary": [
      {
        "eventSource": "iam.amazonaws.com",
        "eventName": "CreateAccessKey"
      }
    ]
  }
}

Konfigurasi alert untuk CloudTrail Insights via CloudWatch:

{
  "AlarmName": "CloudTrail-Insights-High-Severity",
  "MetricName": "InsightEventCount",
  "Namespace": "AWS/CloudTrail",
  "Statistic": "Sum",
  "Period": 300,
  "EvaluationPeriods": 1,
  "Threshold": 1,
  "ComparisonOperator": "GreaterThanOrEqualToThreshold",
  "AlarmActions": ["arn:aws:sns:ap-southeast-1:123456789012:security-alerts"]
}

Alerting dari Log Patterns

AWS - CloudWatch Logs Metric Filter + Alarm

# Buat metric filter untuk mendeteksi root login
aws logs put-metric-filter \
    --log-group-name "CloudTrail/DefaultLogGroup" \
    --filter-name "RootLoginDetected" \
    --filter-pattern '{ ($.userIdentity.type = "Root") && ($.eventType = "AwsApiCall") }' \
    --metric-transformations \
        metricName=RootLoginCount,metricNamespace=SecurityMetrics,metricValue=1

# Buat alarm
aws cloudwatch put-metric-alarm \
    --alarm-name "Root-Activity-Alert" \
    --alarm-description "Root user melakukan API call" \
    --metric-name RootLoginCount \
    --namespace SecurityMetrics \
    --statistic Sum \
    --period 300 \
    --threshold 0 \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 1 \
    --alarm-actions arn:aws:sns:ap-southeast-1:123456789012:security-team

Azure - Log Search Alert

# Buat scheduled query alert untuk failed SSH attempts
az monitor scheduled-query create \
    --name "Failed-SSH-Alert" \
    --resource-group security-rg \
    --description "Alert ketika failed SSH login > 10 dalam 5 menit" \
    --action-groups "/subscriptions/xxx/resourceGroups/security-rg/providers/microsoft.insights/actionGroups/security-team" \
    --evaluation-frequency 5 \
    --window-size 5 \
    --severity 2 \
    --query "
    Syslog
    | where Facility == 'auth' and SeverityLevel == 'err'
    | where SyslogMessage has 'Failed password'
    | summarize FailedCount = count() by Host, SourceIP = extract('from ([^ ]+)', 1, SyslogMessage)
    | where FailedCount > 10
    "

Verifikasi

# AWS - cek integritas log CloudTrail
aws cloudtrail validate-logs \
    --trail-arn arn:aws:cloudtrail:ap-southeast-1:123456789012:trail/production-audit-trail \
    --start-time "2026-07-15T00:00:00Z"

# Azure - query log workspace
az monitor log-analytics query \
    --workspace security-audit-workspace \
    --query "AuditLogs | count"

# GCP - cek log sink
gcloud logging sinks describe admin-activity-sink

Referensi

← Sebelumnya 9.5 Cloud Monitoring Selanjutnya → 9.5.2 Cloud Monitoring
PADA HALAMAN INI