1. Sign in to your Log Archive account using the AWS Management Console.
2. Find the region that you want to deploy the monitoring from.
   1. In the navigation menu, beside your username, click Region.
   2. Select your preferred region.
3. In the Services menu, in the Management & Governance section, click CloudFormation.
4. On the CloudFormation page, click Create stack > With new resources (standard).
5. On the Create stack page, configure these settings:
   • Prepare template — Select Choose an existing template.
   • Template source — Select Amazon S3 URL.
6. In the Arctic Wolf Unified Portal, in the Amazon Web Services (AWS) Monitoring section, copy the appropriate CloudTrail stack link.
7. In the Amazon S3 URL field, enter the appropriate CloudTrail stack link.
8. Click Next.
9. In the Name field, enter a unique name for your stack. For example, ArcticWolf.
10. In the Parameter section, keep the CloudTrail field empty.
11. Click Next.
12. Optional: On the Configure stack options page, add roles, policies, and other configurations, as desired.
13. Click Next.
14. On the Review page, read the Capabilities section.
15. Select all checkboxes.
    Note: You must select all checkboxes to create the stack correctly.
16. Click Submit.

    CloudFormation provides a preview of stack changes, which are prefixed with the Stack name property. This process usually takes 5-10 minutes to complete.

17. Wait until the base stack and all nested stacks have a status of CREATE_COMPLETE before proceeding to the next step, to make sure that the CloudFormation stacks were successfully created.
18. Delete the newly created CloudTrail stack in the Log Archive account.

To configure S3 event notifications, assume the AWSControlTowerExecution role from the Management Account. This role has the permissions needed to modify S3 buckets managed by AWS Control Tower.

1. Log into the Management Account AWS Console with an IAM user that has cross-account assume-role permissions.
2. Open the IAM Console and navigate to Roles.
3. Find and click AWSControlTowerExecution.
4. Review the Trust relationships tab to make sure that your IAM user and role are trusted.
   AWS typically trusts all principals in the Management Account.
5. On the Role Summary page, in the Switch Role section, complete these fields:
   • Account — Enter the Log Archive Account ID.
   • Role Name — AWSControlTowerExecution
   • (Optional) Display Name — Enter a name for the role.
6. Click Switch Role.
7. If you want to:
   • Add role to an existing policy — Edit the IAM policy attached to AWNExternalIDRole to grant arn:aws:s3:::<cloudtrailLogsBucket> the s3:ListBucket and s3:GetObject permissions, where cloudtrailLogsBucket is the S3 bucket that you want to use.
   • Attach a new policy — Create an IAM policy with these permissions and attach it to AWNExternalIDRole:
     JSONCopy

     { "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAWNReadControlTowerLogs", "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:GetObject" ], "Resource": [ "arn:aws:s3:::<cloudtrailLogsBucket>", "arn:aws:s3:::<cloudtrailLogsBucket>/*" ] } ]

     {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Sid": "AllowAWNReadControlTowerLogs",
           "Effect": "Allow",
           "Action": [
             "s3:ListBucket",
             "s3:GetObject"
           ],
           "Resource": [
             "arn:aws:s3:::<cloudtrailLogsBucket>",
             "arn:aws:s3:::<cloudtrailLogsBucket>/*"
           ]
         }
       ]

     Where:
     • cloudtrailLogsBucket is the S3 bucket that you want to use.

1. In the AWS console, navigate to S3.
2. Click Buckets to view all buckets.
3. Find and click the bucket.
4. Click the Properties tab at the top of the bucket view.
5. Scroll down to the Event notifications section.
6. Click Create event notification.
7. Configure the event notification with these settings:

   • Event notification name — Enter a name for the notification. For example, AWNEventNotification.

   • Event types — Select the S3 events to forward to Arctic Wolf. Make sure to include All object create events and s3:ObjectCreated:* for new objects.

   • Destination type — Select SNS Topic

   • SNS Topic — Enter the ARN of the SNS topic that you created in Deploy the CloudTrail stack into the Log Archive Account:

     CODECopy

     arn:aws:sns:<region>:<log_archive_account_id>:AWNSNSTopic

     arn:aws:sns:<region>:<log_archive_account_id>:AWNSNSTopic

     Where:

     • region is your AWS region.
     • log_archive_account_id is the ID of the SNS topic you created.
8. Click Save changes
9. Repeat these steps for each bucket that you need to configure.
   Typically, the required buckets include aws-controltower-logs-*, aws-controltower-cloudtrail-*, or aws-controltower-access-logs-*.

Verify that S3 event notifications are correctly configured.

1. In the SNS console, navigate to Topics.
2. Find and click AWNSNSTopic.
3. In the Subscriptions section, verify that each S3 bucket appears as a subscriber.
4. Optional: Upload a small file to one of the S3 buckets and verify that SNS receives the notification.