cis-aws-compute-10-2

name	cis-aws-compute-10.2
description	Ensure Persistent logs is setup and configured to S3
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","elastic-beanstalk","logging","cloudwatch","s3","monitoring"]
cis_id	10.2
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-10.1","cis-aws-compute-10.3","cis-aws-compute-10.4"]
prerequisites	[]
severity_boost	{}

10.2 Ensure Persistent logs is setup and configured to S3 (Manual)

Description

Elastic Beanstalk can be configured to automatically stream logs to the CloudWatch service.

Rationale

With CloudWatch Logs, you can monitor and archive your Elastic Beanstalk application, system, and custom log files from Amazon EC2 instances of your environments.

Impact

N/A

Audit Procedure

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to review
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Softwares
7. Confirm Log streaming: enabled
8. If status options reads Log streaming: disabled refer to the remediation below.
9. Repeat steps 3-8 for each environment within the current region.
10. Then repeat the Audit process for all other regions.

Using AWS CLI

N/A - This control is manual and console-based.

Expected Result

Log streaming: enabled is displayed under the Softwares category in the environment Configuration.

Remediation

Using AWS Console

1. Login to AWS Console using https://console.aws.amazon.com/elasticbeanstalk
2. On the left hand side click Environments
3. Click on the Environment name that you want to update
4. Under the environment_name-env in the left column click Configuration
5. Scroll down under Configurations
6. Under category look for Software
7. Click on Edit
8. On the Modify software page:

Instance log streaming to CloudWatch Logs
Log streaming - click the Enabled checkbox
Set the required retention based on Organization requirements
Lifecycle - Keep logs after terminating environment

9. Click Apply
10. Repeat steps 3-8 for each environment within the current region that needs Managed updates set.