Oh
[Music]
hello hello welcome to solving with AWS
solutions your deep dive into
architecture is built by AWS that are
ready to deploy instantly in the cloud
I'm Rob your host joined with node.js
ninja Sean how are you doing today Sean
doing great in this episode we are
talking about our centralized logging
solution Sean what problems does this
help our customer solve so if you look
at the typical ad abuse account there's
a lot that's happening service has
produced operational metrics security
data and audit logs and additionally of
your own applications producing web app
in OS level logs man that sounds like a
lot to manage and with more customers
moving towards a multi account strategy
there's a strong desire to centralize
your logs and have a single view of
what's happening across your AWS
properties so that's where centralized
logging comes in exactly it captures all
activity from across your AWS workloads
and centralizes it for analysis what
types of organisations would be
interested in something like this so
centralizing logs comes increasingly
useful for customers who want to manage
multiple applications and even multiple
accounts
additionally customers with audit and
compliance requirements tell us that
they find it useful to be able to
analyze everything all in one place
sounds like this is a low overhead quick
to deploy solution for centralizing and
analyzing log data let's take a closer
look let's do it
so Sean talked to me about centralized
logging what's happening is part of this
architecture so Rob this architecture is
a fundamentally a hub and a spoke ok
driven architecture the spokes represent
a deficit counts you may have many of
those each of those running applications
that have events that drive logs and you
want to sort of view those in one place
okay so we aggregate those logs into the
hub okay bring it all together in that
centralized hub that's exactly right ok
cool well let's take a deeper look so
here we have the landing page in this
solution it gives you an overview of
what's happening the architecture
diagram which we'll walk in just a
second all right but it also has a link
to a CloudFormation template to get up
and running quickly a getting started
guide and if you really want to go deep
we have a link to the code it's a pretty
cool instant way to get deployed on the
your accounts yeah you can get up and
running pretty quickly with this
application awesome take me through a
deeper dive on the architecture sure so
when you launch that first
CloudFormation template that's I mention
in the getting started guide it's gonna
launch this box on the left here okay
that's the primary stacker the hub okay
and what's happening here is it's gonna
launch three important things at least
which is the elasticsearch domain that's
a fully managed distributed search index
okay that's gonna let a search against
the log to see what's happening in our
account okay we're gonna want to
visualize that and we're gonna use a
cabana client to get to dashboard
essentially what's happening in our
account okay so we have a bunch of these
hubs that are out there bringing it
together a lot of sensitive data coming
through with that how do we restrict
access so a good question we saw for
that using Amazon kognito okay
essentially we have a user pool that we
authenticate against to grant only
people who have the right credentials
access to that command dashboard so
what's happening is part of this
secondary stack that I see so that's
secondary stack which we have down here
that's the spoke account okay we've
deployed sample out there to give us a
sense of generating traffic driving some
events and letting up these dashboard in
the real world these would be the
services were running that we want to
bring back to the hub exactly okay and
so in this demo lab we kind of blow that
up over here okay that's running that
ec2 incident with a cloud watch agent
that's sucking up the logs and sending
them over here to cloud watch okay what
other types of logs can we gather from
the spokes so we can get all sorts of
different logs we turn on VPC flow logs
okay which is gonna give us a whole lot
of network level logging all right as
well as AWS cloud trail that's gonna
capture all the events from all the
different services that we're using and
send them also to cloud watch as well
for aggregation okay cool
so let's go back and talk more about the
cabana client what's happening is part
of that so that Cabana client is
allowing us to essentially dashboard and
visualize what's going on in our account
in near-real-time
you could actually see what's going on
yeah why don't we actually go take a
look right now okay cool
so I've got one up and running here and
as you can see there's a ton of data and
this came out of the box as part of the
CloudFormation template that's exactly
right cool customers can use this but
they can extend it change it throw away
and customize it
exactly so some of the sample data here
we've got essentially packets that are
being accepted and rejected from VPC
we've also got a view of where that data
is coming from which source addresses
who is sort of potentially a suspicious
actor mm-hmm we can get a sense and give
us clues of where we might want our dev
ops team to drill into further all right
what other types of information can we
get from this so we can also look for
maybe applications that might not be
behaving as as expected so we have
account of our HTTP error codes that are
happening both in the 400-500 levels
things that we might want to jump into
make sure our customers are having a
good experience cool anything else as
part of this commander client I mean
there's a whole lot of data that
customers can add we've we've dashboard
adhere the top ten access keys you know
maybe someone's overusing keys
again another clue to make sure things
are working okay and what we want to
keep an eye on so this seems like a
great way to visualize all the different
logs that are coming together from the
spoke account exactly awesome well
thanks for walking through this
architecture with me yeah no problem
cool centralized logging is something
customers can quickly deploy to start
monitoring their multi account
environments and position themselves to
meet their audit and compliance
requirements and aside from
elasticsearch this is a service solution
using native AWS components like cloud
watch cloud trail and VPC flow logs all
visualized through a Cabana dashboard -
check it out centralized logging and
other AWS solutions go to our AWS
solutions page thanks and see you next
time good
you
[Music]