Where can I find logs for denied access through firewall

I have inbound rules restricting access to our database based on IP address and have specified our websites IP address (Siteground) to give it access and that works the majority of the time. Occasionally, I'm getting connection timed out on the Siteground logs when trying to connect to the database, but then it works immediately after.

Siteground just moved the server to a new database center and I've updated the IPs but this started after. They're saying there is no way the IP address is changing so I want to verify it in the Amazon logs but can't find them.

주제

보안, 신원 및 규정 준수 AWS Well-Architected 프레임워크

태그

AWS 방화벽 관리자 보안

언어

English

phantomfather

질문됨 일 년 전368회 조회

2개 답변

최신
최다 투표
가장 많은 댓글

수락된 답변

Requests made to AWS Firewall Manager can be logged at AWS CloudTrail Logs. https://docs.aws.amazon.com/waf/latest/developerguide/fms-incident-response.html

Make sure you have all the permissions for log delivery.

Felipe Gonzales

답변함 일 년 전

전문가

Sedat Salman

검토됨 일 년 전

phantomfather
일 년 전
Thank you. That's exactly what I was looking for. Not the most intuitive solution from Amazon, but once you know it, it makes sense.

When you say firewall, do you mean the RDS security group?
If you are a security group, you can enable VPC flow logging to see the blocked logs.
https://docs.aws.amazon.com/vpc/latest/userguide/working-with-flow-logs.html

전문가

Riku_Kobayashi

답변함 일 년 전

Where can I find logs for denied access through firewall

관련 콘텐츠