Setting up SQS Queue (Limited Availability)

This article helps you configure Amazon Simple Queue Service (SQS) as a log transport to ship event logs.

Step 1: Set up an SQS queue

Anomali recommends that you create a standard SQS queue. You can create a standard queue by following Amazon's guide to creating a standard queue.

Step 2: Create an IAM user

Once you successfully set up your queue, you must create an IAM user. See Amazon's guide to Create an IAM user for more information.

Step 3: Grant necessary permissions

While creating an IAM user, you must ensure your IAM user policy grants Anomali all the necessary permissions to pull and read data, depending on any change notifications the queue receives.

In the example code block below, the IAM user policy grants Anomali the following permissions:

1. Decryption: If your S3 bucket data is encrypted by Amazon Key Management System (KMS), Anomali must decrypts the logs. In the example below, the data is encrypted by the KMS key ebf456c-39fa-67ff-bae1-95710483d2f7. KMS key UUIDs are alphanumeric IDs that contain 0-9 and a-f.

   Note: You must know the key used to encrypt your bucket that stores the logs. Contact your S3 account admin for more information.

2. Queue actions: Anomali gets the queue URL and attributes (such as ARN), receives and deletes messages, and can change the visibility timeout of a message.

3. S3 user: Anomali reads the logs from your S3 bucket, in this case named anomali-cloudtrail-test.

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "KMS",
			"Effect": "Allow",
			"Action": [
				"kms:Decrypt",
				"kms:GenerateDataKey"
			],
			"Resource": [
				"arn:aws:kms:us-east-1:123456789012:key/0b29456c-39fa-67ff-bae1-95710483d2f7"
			]
		},
		{
			"Sid": "SQS",
			"Effect": "Allow",
			"Action": [
				"sqs:DeleteMessage",
				"sqs:GetQueueUrl",
				"sqs:ChangeMessageVisibility",
				"sqs:ReceiveMessage",
				"sqs:GetQueueAttributes"
			],
			"Resource": [
				"arn:aws:sqs:us-east-2:123456789012:queue2"
			]
		},
		{
			"Sid": "S3",
			"Effect": "Allow",
			"Action": [
				"s3:GetObject"
			],
			"Resource": [
				"arn:aws:s3:::anomali-cloudtrail-test/*"
			]
		}
	]
}

See Amazon's guide to create a custom Amazon SQS access policy and how SQS works with IAM for more information on IAM policies.

Step 4: Retrieve access keys

While creating the IAM user for Anomali, securely note your Access Key ID and Secret Access Key. These credentials are required to create a new log source in the Anomali platform.

If you don't have your Access Key ID and Secret Access Key set up, see Amazon's guide to Create New Access Keys for an IAM User.

Step 5: Obtain SQS queue URL

To create a new log source in the Anomali platform, you will also need the queue URL. To obtain the URL:

1. Sign in to your AWS Management console.

2. Navigate to the AWS SQS dashboard.

3. Click on the name of the queue you created to send logs to Anomali.

The queue URL is displayed in the Details section.