Build AWS Infrastructure for Cortex XSIAM/XDR Ingestion of Cisco Umbrella/Secure Access Logs

This Terraform module builds all the AWS infrastructure/components required to facilitate the ingestion of Cisco Umbrella/Secure Access logs into Palo Alto Networks Cortex XSIAM and XDR.

Cisco Umbrella/Secure Access can be configured to store logs in an S3 bucket, and Cortex XSIAM/XDR can be configured to ingest logs from an S3 bucket. This module creates an S3 bucket for this purpose, as well as creating the other components required such as an IAM role, SQS queue, etc

This module also creates two sets of user credentials, which can be provided to other tooling which requires access to the Umbrella/Secure Access logs.

Reference Links:

• https://cortex.marketplace.pan.dev/marketplace/details/Ciscoumbrellacloudsecurity/
• https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Ingest-Generic-Logs-from-Amazon-S3 -https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Create-an-Assumed-Role
• https://docs.umbrella.com/umbrella-user-guide/docs/enable-logging-to-your-own-s3-bucket

Requirements

Name	Version
terraform	>= 1.5, < 2.0
aws	~> 5.70

Providers

Name	Version
aws	~> 5.70

Modules

No modules.

Resources

Name	Type
aws_iam_access_key.user1_access_key	resource
aws_iam_access_key.user2_access_key	resource
aws_iam_policy.xsiam_umbrella_access_policy	resource
aws_iam_role.xsiam-umbrella_assume-role	resource
aws_iam_role_policy_attachment.xsiam-umbrella_assume-role_policy_attach	resource
aws_iam_role_policy_attachment.xsiam_umbrella_access_policy_attach	resource
aws_iam_user.user1	resource
aws_iam_user.user2	resource
aws_s3_bucket.audit_logs	resource
aws_s3_bucket.xsiam_umbrella	resource
aws_s3_bucket_logging.bucket_logging	resource
aws_s3_bucket_notification.xsiam_umbrella	resource
aws_s3_bucket_policy.audit_logs_policy	resource
aws_s3_bucket_policy.xsiam_bucket_policy	resource
aws_sqs_queue.xsiam_umbrella	resource
aws_sqs_queue.xsiam_umbrella_deadletter	resource
aws_sqs_queue_policy.xsiam_umbrella	resource
aws_sqs_queue_redrive_allow_policy.xsiam_umbrella	resource
aws_caller_identity.current	data source
aws_iam_policy_document.audit_logs_policy	data source
aws_iam_policy_document.xsiam-umbrella_assume-role_trust_policy	data source
aws_iam_policy_document.xsiam_bucket_policy	data source
aws_iam_policy_document.xsiam_umbrella	data source
aws_iam_policy_document.xsiam_umbrella_access_policy	data source

Inputs

Name	Description	Type	Default	Required
bucket_name	A name used for the S3 bucket where Umbrella/Secure Access logs will be stored	string	n/a	yes
external_id	The external ID used for IAM role trust relationship	string	n/a	yes
project_name	A unique project name, used for tagging and naming AWS resources	string	n/a	yes
region	The AWS region in which resources will be deployed	string	n/a	yes
umbrella_aws_account_id	The AWS account ID for Umbrella/Secure Access; the account used to write Umbrella logs to S3	string	"568526795995"	no
xsiam_aws_account_id	The AWS account ID for XSIAM; the account used to read Umbrella/Secure Access logs from S3	string	"006742885340"	no

Outputs

Name	Description
assumed_role_arn	ARN for the AWS Assumed Role
bucket_name	Name of the S3 Bucket
external_id	External ID for the AWS Assumed Role
sqs_queue_url	URL for the SQS Queue
user1_access_key	Access key for first user, if required
user1_secret_key	Secret key for first user, if required
user2_access_key	Access key for second user, if required
user2_secret_key	Secret key for second user, if required