Control: 2.7 Ensure Web Application Firewall access and security log service is enabled
Description
Log Service collects log entries that record visits to and attacks on websites that are protected by Alibaba Cloud Web Application Firewall (WAF), and supports real-time log query and analysis. The query results are centrally displayed in dashboards.
Remediation
Perform the following ensure the Anti-DDoS access and security log is enabled:
From Console
- Logon to WAF Console.
- Choose
App Market > App Management. - Select the region where your WAF instance is located.
- Click
UpgradeinReal-time Log Query and Analysis Service. EnableLog Service.- Select the log storage period and the log storage size, and click
Buy Now. - Return to the WAF Console and choose
App Market > App Management, and then clickAuthorizeinReal-time Log Query and Analysis Service. - Click
Agreeto authorize WAF to write log entries to your exclusive logstore. - Return to the WAF Console and choose
App Market > App Managementand then, clickConfigureinReal-time Log Query and Analysis Service. - On the
Log Servicepage, select the domain name of your website that is protected by WAF, and turn on theStatusswitch on the right to enable WAF Log Service. These log entries can be queried and analyzed in real time.
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_2_7Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_2_7 --shareSQL
This control uses a named query:
select 'arn:acs:::' || account_id as resource, 'info' as status, 'Manual verification required.' as reason , account_id as account_idfrom alicloud_account;