What is function of Download GeoIP lambda and GeoIP S3 bucket?

The Download GeoIP lambda function is used for downloading GeoIPs from MaxMind and then GeoIP S3 bucket is used for storing the downloaded GeoIPs.

When you view/analyze logs in OpenSearch dashboard, you can add country information as well as latitude/longitude location information to each IP address. To get location information, SIEM on OpenSearch Service downloads and uses GeoLite2 Free by MaxMind. If you want to add location information, get your free license from MaxMind.

Refer to the following for more information:

• https://github.com/aws-samples/siem-on-amazon-opensearch-service
• https://catalog.us-east-1.prod.workshops.aws/workshops/60a6ee4e-e32d-42f5-bd9b-4a2f7c135a72/en-US