Amazon VGT2 Las Vegas: Analyzing Azure Audit Logs with CloudTrail Lake

Introduction

More Info

In today’s rapidly changing cloud landscape, ensuring strong security and compliance is essential. With the increasing adoption of multicloud architectures, the demand for thorough monitoring and logging solutions is more important than ever. This is where the combination of Azure Audit Logs and AWS CloudTrail Lake comes into play—offering valuable insights across your cloud environments.

Azure Audit Logs provide in-depth visibility into actions carried out within your Azure environment, tracking activities and changes to uphold compliance and security. Conversely, AWS CloudTrail Lake allows you to securely store, access, and analyze your cloud activity logs from a centralized location, complete with advanced querying features and long-term data retention.

In this post, we will guide you through deploying a sample solution to ingest your Azure activity logs into a CloudTrail Lake event data store. We will also provide example SQL queries to facilitate data analysis and support security investigations. Whether you are a cloud architect, security analyst, or IT manager, this guide aims to empower you with the knowledge to fully leverage your cloud audit logs.

Prerequisites

To follow this guide, you’ll need the following:

• AWS CLI: Install the AWS Command Line Interface.
• SAM CLI: Install the Serverless Application Model Command Line Interface for building and testing AWS Lambda applications.
• Python 3.12 or newer: Ensure you have Python installed.
• An AWS account: This should include an AWS Identity and Access Management (IAM) role with the necessary permissions to provision required resources.
• An Azure account: This should have sufficient access to provision resources and send logs to AWS.

AWS Setup

1. Enable CloudTrail Lake by following the steps outlined in this blog post.
2. Create a secret in AWS Secrets Manager to store the connection string for your Azure Storage account.

Azure Setup

1. Create an Azure storage account: This account will encompass all your Azure Storage data objects—such as blobs, files, queues, and tables—providing a unique namespace for your data accessible via HTTP or HTTPS. For more details, refer to the Storage account overview.
2. Register a client application in Microsoft Entra ID for accessing Azure Health Data Services.
3. Provide the Azure storage account connection string, which includes the DefaultEndpointsProtocol, AccountName, AccountKey, and EndpointSuffix for the AWS CloudFormation stack deployment.

Solution Overview