Use of Assumed Roles of aws for aws monitoring

[Asmit Desai]

Hi Team 

I am working on integrating github with wazuh using log streaming options as i dont wanna use PAT as per the documentation of wazuh. I wanted to understand that if i can use an assumed role concept instead of creating a IAM user 

Thanks 

Asmit 

[hasitha.u...@wazuh.com]

Hi Asmit

I will review this internally and get back to you with an update. Kindly allow me some time to investigate further.

[hasitha.u...@wazuh.com]

Hi Asmit,

Yes, we believe this is possible. Instead of using a personal access token with the native GitHub module, you can stream your GitHub audit logs to an AWS S3 bucket and have Wazuh read them from there. GitHub's audit log streaming supports S3 as a destination, so the flow becomes GitHub to S3, then S3 to Wazuh.

GitHub covers the streaming setup here, depending on your edition:

Enterprise Cloud: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise

Enterprise Server 3.17: https://docs.github.com/en/enterpri...@3.17/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise

On the assumed role side of your question, I've raised it with our internal team so I can give you a precise answer with more detail. I'll follow up and update this thread once I hear back.

[Asmit Desai]

Is there an update for the assumed role for aws S3 monitoring