Amazon Elastic Load Balancer (ELB)

Samurai [Local] Collector	Samurai [Cloud] Collector

This guide describes the steps required to configure Amazon Web Services (AWS) to send Elastic Load Balancer (ELB) logs to S3 storage for ingestion to Samurai via a cloud collector.

Prerequisites

Ensure that an AWS cloud collector has been deployed via the Samurai MDR portal. 

• Guide available here

If you are planning to reuse an already deployed cloud collector, the information can be found via:

1. Navigate to the Samurai MDR portal.
2. Click Telemetry and select Collectors from the main menu
3. Click on the name of the desired collector.
4. Note down information:

• Account number
• Bucket name
• Region

Alternatively, you can utilize the integration setup wizard via the Samurai MDR portal for the desired telemetry source listed on Product Integration Guide page which shall provide you the same information required to setup your telemetry source.

Enabling Elastic Load Balancer Logging

1. Follow the official AWS documentation guide:

   • Enable access logs for your Application Load Balancer

2. Attach a policy to your S3 bucket:

   • Navigate to Step 2: Attach a policy to your S3 bucket.
   • At this stage, you should have already created an S3 bucket or selected an existing one.
   • Ensure that the policy you attach grants the necessary permissions for ELB to write logs to the bucket.

3. Configure access logs:

   • Proceed to Step 3: Configure access logs.
   • Specify the correct S3 bucket name and prefix.
   • Make sure to use the appropriate S3 URI corresponding to the bucket created or selected previously.

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai MDR application and we shall get it updated.