OpenParable
Skip to content
← Back to skills

Cis AWS Euc 3.1

DevOps & Security
cis-aws-euc-3.1

Cis AWS Euc 3.1 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure User Access Logging is enabled

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/AWS/CIS_AWS_End_User_Compute_Services_Benchmark_v1.2.0/cis-aws-euc-3.1/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/cis-aws-euc-3-1, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Ensure User Access Logging is enabled (Manual)

Description

User Access Logging can record the following user events:

  • Session Start - when a WorkSpaces Web sessions begins.
  • Session End - when a WorkSpaces Web session ends.
  • URL Navigation - when a user loads a URL.

User Access logging can be setup to record user events.

Rationale

Logging user activity will assist in event correlation if response to an incident is needed.

Impact

None

Audit Procedure

Using AWS Console

  1. Log in to the WorkSpaces console at https://console.aws.amazon.com/workspaces-web/
  2. In the left pane, click Web portals.
  3. Click the link for correspoinidng web portal.
  4. Scroll to the User access logging section
  5. Verify the Kinesis data stream arn is set.

If no Kinesis data streams are listed are defined then user access logging is not enabled.

Using AWS CLI

  1. From the command line run the list-user-access-logging-settings:
aws workspaces-web list-user-access-logging-settings --output table
  1. The command should output a table with the listed settings.

If no settings are defined then user access logging is not enabled.

Expected Result

A Kinesis data stream is configured for user access logging.

Remediation

Using AWS Console

  1. Log in to the Amazon Kinesis console at https://console.aws.amazon.com/kinesis/home
  2. In the left pane, click Data Streams then Create data stream.
  3. Enter a name for your data stream. The name must be prefixed with amazon-workspaces-web
  4. Select the desired data stream capacity and click Create data stream
  5. Log into the Amazon WorkSpaces console at https://console.aws.amazon.com/workspaces/v2/home
  6. In the left pane click Web Portals
  7. Click the link for the web portal you wish to edit.
  8. Click Edit
  9. Scroll to User access logging and select the Kinesis data stream you created above.
  10. Click Save

Using AWS CLI

  1. Run the create-user-access-logging-settings command:
aws workspaces-web create-user-access-logging-settings --kinesis-stream-arn
<kinesis_data_stream_arn>. --output table
  1. The output will return a list of settings

Default Value

By default, user access logging is not enabled.

References

  1. https://docs.aws.amazon.com/workspaces-web/latest/adminguide/data-protection-logging.html

CIS Controls

This control does not have explicit CIS Controls mappings in the PDF.

Profile

Level 1