Session Audit Implementation

Configure the connector, storage, and integrations required for auditing privileged access sessions

Session Audit captures privileged access session activity after the required connector, network, storage, and integration settings are configured. This article walks through the setup required to enable it.

Prerequisites

Item

Description

Supported integration

One of the following Apono integrations:

Kubernetes: Kubernetes
SSH: SSH Servers or AWS EC2 SSH Servers

Apono connector

On-prem connection serving as a bridge between the integration and Apono

Required Version: 1.8.3

Learn how to update an existing AWS or Kubernetes connector.

Connector endpoint

DNS address used to establish audited sessions through the connector proxy

Network access

Client machines must be able to resolve the connector endpoint and connect to port 10021 (Kubernetes) or 10022 (SSH).

Kubernetes Command Line Tool (kubectl)

(Kubernetes) Command-line tool used for communicating with a Kubernetes cluster's control plane

For audited Kubernetes sessions, kubectl 1.24 or later is supported on macOS, Linux, and Windows.

Connector configuration

The Apono connector should be configured according to your deployment type:

Use the EKS steps for Kubernetes-based connectors
Use the ECS CloudFormation or ECS Terraform steps for ECS-based connectors.

Follow these steps to configure the connector:

Verify AWS Load Balancer Controller is installed on the EKS cluster.

If it is not installed, install the AWS Load Balancer Controller before continuing.

Obtain the EKS cluster OIDC provider.

export OIDC_PROVIDER=$(aws eks describe-cluster \
  --name <EKS_CLUSTER_NAME> \
  --query "cluster.identity.oidc.issuer" \
  --output text | sed 's#^https://##')

echo $OIDC_PROVIDER

Save the following trust policy as apono-connector-trust-policy.json.

The connector uses IAM Roles for Service Accounts (IRSA) so its EKS pods can access AWS services through this IAM role. The following trust policy allows only the connector service account in this namespace to assume the role via OIDC.

Replace <AWS_ACCOUNT_ID>, <OIDC_PROVIDER>, and <NAMESPACE> before saving the file. The OIDC provider value should not include https://.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/<OIDC_PROVIDER>"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<OIDC_PROVIDER>:sub": "system:serviceaccount:<NAMESPACE>:apono-connector-service-account"
        }
      }
    }
  ]
}

Create or update the IAM role trust policy.

aws iam create-role \
  --role-name "${CONNECTOR_ROLE_NAME}" \
  --assume-role-policy-document file://apono-connector-trust-policy.json

Confirm that the role trust policy is configured correctly.

aws iam get-role \
  --role-name "${CONNECTOR_ROLE_NAME}"

Create and configure an S3 bucket.
Create and attach the S3 write policy to the role created or updated above.
Add the following configuration to your Helm values file, for example values.yaml. The proxyService block provisions a Network Load Balancer (NLB) that exposes the Apono connector on ports 10020-10024.

To control which subnets are used for the NLB, set service.beta.kubernetes.io/aws-load-balancer-subnets to a comma-separated list of subnet IDs with no spaces ("subnet-XXX,subnet-XXX").

# values.yaml
apono:
  token: "${APONO_TOKEN}"
  connectorId: "${CONNECTOR_ID}"

serviceAccount:
  manageClusterRoles: true

proxyService:
  enabled: true
  type: LoadBalancer
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
    service.beta.kubernetes.io/aws-load-balancer-subnets: "${SUBNET_IDS}"

Upgrade the Apono connector Helm chart to v2.0.34 with the values file.

helm upgrade --install apono-connector apono-connector \
  --repo https://apono-io.github.io/apono-helm-charts \
  --version v2.0.34 \
  -f values.yaml

Annotate the connector service account with the IAM role ARN so the connector can authenticate to S3.

kubectl annotate serviceaccount apono-connector-service-account \
-n <NAMESPACE> \
eks.amazonaws.com/role-arn=<ROLE_ARN> \
--overwrite

Verify that your VPN, security groups, and internal DNS allow developer machines to resolve and connect to the NLB DNS name on port 10021 (Kubernetes) or 10022 (SSH).

The NLB is provisioned as internal by default.

Choose the configuration path that matches your deployment architecture.

Same AWS account

Use this path when the ECS connector and Session Audit S3 bucket are in the same AWS account.

Follow these steps to configure the connector:

Install a new ECS connector with AWS permissions.
Update your Terraform configuration to use the NLB-enabled connector module and set the required NLB parameters.

The Terraform module provisions a Network Load Balancer (NLB) for audited sessions and exposes ports 10020–10024. Set nlbScheme and nlbSubnetIds to control NLB visibility and subnet placement.

provider "aws" {
    region = "{var.REGION}"
}

module "apono-connector" {
    source = "http://github.com/apono-io/terraform-modules//aws/connector-with-permissions-nlb/stacks/apono-connector?ref=v1.0.46"
    connectorId = "{var.CONNECTOR_ID}"
    aponoToken = "{var.APONO_TOKEN}"
    vpcId = "{var.VPC_ID}"
    subnetIds = "{var.SUBNET_IDS}"
    assignPublicIp = true
    nlbScheme = "internal"
    nlbSubnetIds = "{var.ENDPOINT_SUBNET_IDS}"
	
    tags = "{var.TAGS}"
}

Parameter

Description

nlbScheme string

Defines the NLB visibility

Set to internet-facing if the connector needs to be reachable from outside your VPC.

Default: internal

nlbSubnetIds list(string)

Subnets to associate with the NLB

This value is required when nlbScheme is set to internet-facing.

Default: []

Create and configure an S3 bucket in the same AWS account as the connector.
Create and attach the S3 write policy to an existing connector IAM role.
Verify that your VPN, security groups, and internal DNS allow developer machines to resolve and connect to the NLB DNS name on port 10021 (Kubernetes) or 10022 (SSH).

Cross-account or organization-level

Use this path when the ECS connector is used for an AWS Organization deployment, or when the Session Audit S3 bucket is in a different AWS account than the connector.

Follow these steps to configure the connector:

Install a new ECS connector with AWS permissions.
Update your Terraform configuration to use the NLB-enabled connector module and set the required NLB parameters.

provider "aws" {
    region = "{var.REGION}"
}

module "apono-connector" {
    source = "http://github.com/apono-io/terraform-modules//aws/connector-with-permissions-nlb/stacks/apono-connector?ref=v1.0.46"
    connectorId = "{var.CONNECTOR_ID}"
    aponoToken = "{var.APONO_TOKEN}"
    vpcId = "{var.VPC_ID}"
    subnetIds = "{var.SUBNET_IDS}"
    assignPublicIp = true
    nlbScheme = "internal"
    nlbSubnetIds = "{var.ENDPOINT_SUBNET_IDS}"
	
    tags = "{var.TAGS}"
}

Parameter

Description

nlbScheme string

Defines the NLB visibility

Set to internet-facing if the connector needs to be reachable from outside your VPC.

Default: internal

nlbSubnetIds list(string)

Subnets to associate with the NLB

This value is required when nlbScheme is set to internet-facing.

Default: []

Create and configure an S3 bucket in the same AWS account as the connector.

The bucket policy grants access to connector roles that match the aws:PrincipalTag/apono-connector-s3-access and aws:PrincipalOrgID conditions.

Create and attach the S3 write policy to an existing connector IAM role.
Verify that your VPN, security groups, and internal DNS allow developer machines to resolve and connect to the NLB DNS name on port 10021 (Kubernetes) or 10022 (SSH).

Create a policy

Follow these steps:

Save the following S3 write policy locally as apono-connector-s3-session-audit-policy.json.

The organization ID can be found in the CloudFormation stack.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ConnectorS3ReadWrite",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::<BUCKET_NAME_PREFIX>*/*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/apono-connector-s3-access": "true",
          "aws:PrincipalOrgID": "${PRINCIPAL_ORG_ID}"
        }
      }
    },
    {
      "Sid": "ConnectorS3ListBucket",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::<BUCKET_NAME_PREFIX>*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/apono-connector-s3-access": "true",
          "aws:PrincipalOrgID": "${PRINCIPAL_ORG_ID}"
        }
      }
    }
  ]
}

Create the policy in AWS. The output will include a policy ARN that resembles: arn:aws:iam::<AWS_ACCOUNT_ID>:policy/apono-connector-s3-session-audit-policy.

aws iam create-policy \
  --policy-name apono-connector-s3-session-audit-policy \
  --policy-document file://apono-connector-s3-session-audit-policy.json

Copy the ARN. This will be used to attach the policy to the IAM role.
Attach the policy to the existing connector IAM role.

aws iam attach-role-policy \
  --role-name "<CONNECTOR_ROLE_NAME>" \
  --policy-arn "arn:aws:iam::<AWS_ACCOUNT_ID>:policy/apono-connector-s3-session-audit-policy"

Tag the connector IAM role so it matches the aws:PrincipalTag/apono-connector-s3-access condition in the S3 policy.

Without this tag, the connector role can be denied S3 access, even after the policy is attached.

aws iam tag-role \
  --role-name "<CONNECTOR_ROLE_NAME>" \
  --tags "Key=apono-connector-s3-access,Value=true"

Create an S3 bucket

Follow these steps:

Set the bucket variables.

export BUCKET_NAME="<BUCKET_NAME>"
export AWS_REGION="<AWS_REGION>"

Create the region-specific S3 bucket.

To use Object Lock retention for Session Audit data, include --object-lock-enabled-for-bucket when creating the bucket.

aws s3api create-bucket \
  --bucket "$BUCKET_NAME" \
  --region us-east-1

Block public access on the S3 bucket.

aws s3api put-public-access-block \
  --bucket "$BUCKET_NAME" \
  --public-access-block-configuration \
BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

Set ownership controls to BucketOwnerEnforced .

aws s3api put-bucket-ownership-controls \
  --bucket "$BUCKET_NAME" \
  --ownership-controls '{"Rules":[{"ObjectOwnership":"BucketOwnerEnforced"}]}'

Enable default server-side encryption with SSE-S3 (AES256). For SSE-KMS, replace the encryption configuration with your approved customer-managed, KMS key configuration.

aws s3api put-bucket-encryption \
  --bucket "$BUCKET_NAME" \
  --server-side-encryption-configuration '{
    "Rules": [
      {
        "ApplyServerSideEncryptionByDefault": {
          "SSEAlgorithm": "AES256"
        }
      }
    ]
  }'

Enable versioning.

aws s3api put-bucket-versioning \
  --bucket "$BUCKET_NAME" \
  --versioning-configuration Status=Enabled

Tag the bucket.

aws s3api put-bucket-tagging \
  --bucket "$BUCKET_NAME" \
  --tagging '{
    "TagSet": [
      {"Key": "apono-connector-s3-access", "Value": "true"}
    ]
  }'

(Recommended) Configure Object Lock retention according to your organization’s audit log retention policy.

This step applies only if Object Lock was enabled when the bucket was created in step 2.

Object Lock retention helps protect session audit data from being deleted or overwritten for a defined period.

If the bucket and Apono connector are not in the same AWS account, or if your same-account deployment requires an explicit bucket policy, save the following bucket policy locally as apono-session-audit-bucket-policy.json.

Same-account deployments do not always require an additional bucket policy. However, one may still be required if access is restricted by an existing bucket policy, key policy, organization guardrail, or other control.

Additionally, the organization ID can be found in the CloudFormation stack.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowConnectorAccessByTag",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::<BUCKET_NAME>/*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/apono-connector-s3-access": "true",
          "aws:PrincipalOrgID": "<PRINCIPAL_ORG_ID>"
        }
      }
    },
    {
      "Sid": "AllowConnectorListBucketByTag",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::<BUCKET_NAME>",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/apono-connector-s3-access": "true",
          "aws:PrincipalOrgID": "<PRINCIPAL_ORG_ID>"
        }
      }
    },
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<BUCKET_NAME>",
        "arn:aws:s3:::<BUCKET_NAME>/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

Apply the bucket policy from the AWS account that owns the S3 bucket to grant the Apono connector permissions to the bucket.

aws s3api put-bucket-policy \
  --bucket <BUCKET_NAME> \
  --policy file://apono-session-audit-bucket-policy.json

Confirm that the bucket policy was applied.

aws s3api get-bucket-policy \
  --bucket <BUCKET_NAME>

⬆️ Return to EKS or ECS.

Enable Session Audit

You must enable Session Audit within the Apono connector and the SSH or Kubernetes integration.

Once the connector configuration is completed, notify your Apono contact to enable the feature together.

After Session Audit has been enabled, you can review and download session information from the Session History tab.

Connector enablement

Follow these steps to enable Session Audit for the connector:

On the Connectors tab, in the row of the Apono connector associated with the integration, click ︙ > Edit. The Edit Connector page appears.
Toggle Audit sessions to ON. The toggle will appear green when enabled.
Under Session History Bucket ARN, enter your S3 bucket ARN.
Enter the Connector Endpoint.
Click Update Connector.

Integration enablement

Enabling audit sessions has the following effects on resource access based on associated access flow.

Self Serve

On the first request after enablement, new parameters pointing to the connector will be set.

Existing active sessions will not be revoked.

Automatic

Credentials must be refreshed after enablement.

To refresh credentials, grantee access must be revoked.

Follow these steps:

On the Activity page, click the row of the request. The Access request details panel opens
Click Revoke Access. A confirmation pop-up window appears.
Click Yes.

Follow these steps to enable Session Audit for the integration:

On the Connected tab, in the row of your SSH or Kubernetes integration, click ︙ > Edit. The Edit Integration page appears.
Under Get more with Apono, toggle Audit sessions to ON. The toggle will appear green when enabled.

PreviousSession Audit NextSession Audit Reference

Last updated 20 days ago

Was this helpful?