AWS

If the Logpresso server runs in an isolated (air-gapped) network and must communicate with the AWS cloud, you need to configure AWS Private Endpoints. If the Logpresso server does not run in an isolated network, you can skip this step.

Assumptions

• Private Endpoint configuration assumes that an IPsec tunnel and a dedicated private network have already been set up. If this infrastructure is not yet in place, network design and deployment must be completed first.
• The configuration described in this document is based on a typical AWS account structure and network configuration.
• Depending on your organization's AWS structure, some items may need to be modified or adjusted.

Private Endpoint Configuration

1. In the Endpoints console, click Create endpoint.

   

2. On the Create endpoint page, select or enter the required settings, then click Create endpoint at the bottom of the page.

   

   • For Type, select AWS services.

   • Under Services, select the services you need as follows.

     Service	AWS service to collect
     com.amazonaws.ap-northeast-2.s3	AWS ALB, CloudTrail, GuardDuty, WAF
     com.amazonaws.ap-northeast-2.monitoring	AWS Shield (CloudWatch)
     com.amazonaws.ap-northeast-2.sts	STS (see the note below)

   • For VPC and Security groups, use the values configured for your internal PrivateLink setup.

   Note

   com.amazonaws.ap-northeast-2.sts is used only when the Logpresso Sonar server accesses AWS services with temporary credentials (STS). Skip it if you do not use STS.

3. Verify the created endpoints.

   

4. Check the DNS name of each created endpoint. The DNS names are used when you configure the connection profile.

   

   Endpoints are displayed in the following format.

   • S3: *.vpce-***************.s3.ap-northeast-2.vpce.amazonaws.com
   • CloudWatch: vpce-***************.monitoring.ap-northeast-2.vpce.amazonaws.com
   • STS: vpce-***************.sts.ap-northeast-2.vpce.amazonaws.com