[Yandex Cloud documentation](../../../index.md) > [Yandex Audit Trails](../../index.md) > [Tutorials](../index.md) > Exporting audit logs to SIEM systems > [Uploading audit logs to SIEM KUMA](index.md) > Terraform

# Uploading audit logs to KUMA SIEM through Terraform

# Uploading Yandex Audit Trails audit logs to KUMA SIEM through Terraform


To configure delivery of audit log files to [KUMA](https://www.kaspersky.com/enterprise-security/unified-monitoring-and-analysis-platform):

1. [Get your cloud ready](#before-begin).
1. [Create the infrastructure](#deploy).
1. [Mount the bucket on a server](#mount-bucket).
1. [Configure the KUMA collector](#setup-collector).

If you no longer need the resources you created, [delete them](#clear-out).


## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../../billing/quickstart/index.md) and [link](../../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The cost of support for a new Yandex Cloud infrastructure includes:

* Fee for data storage, data operations, and outgoing traffic (see [Yandex Object Storage pricing](../../../storage/pricing.md)).
* Fee for a symmetric encryption key and cryptographic operations (see [Yandex Key Management Service pricing](../../../kms/pricing.md)).
* Optionally, fee for a continuously running VM (see [Yandex Compute Cloud pricing](../../../compute/pricing.md)).
* Optionally, fee for a dynamic or static external IP address (see [Yandex Virtual Private Cloud pricing](../../../vpc/pricing.md)).

In addition, to complete the tutorial, you will need a KUMA user [license](https://kb.kuma-community.ru/books/kuma-how-to/page/model-licenzirovaniia-kuma) (not supplied by Yandex Cloud).


## Create an infrastructure {#deploy}

With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.

For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

To create an infrastructure using Terraform:

1. [Install Terraform](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform), [get the authentication credentials](../../../tutorials/infrastructure-management/terraform-quickstart.md#get-credentials), and specify the source for installing the Yandex Cloud provider (see the [Configure your provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider) section, Step 1).
1. Set up your infrastructure description file:

    {% list tabs group=infrastructure_description %}

    - Ready-made configuration {#ready}

      1. Clone the repository with configuration files:

          ```bash
          git clone https://github.com/yandex-cloud-examples/yc-audit-trails-kuma-integration
          ```

      1. Navigate to the repository directory. It should now contain the following files:

          * `at-events-to-kuma.tf`: New infrastructure configuration.
          * `at-events-to-kuma.auto.tfvars`: User data.

    - Manually {#manual}

      1. Create a folder for the infrastructure description file.
      1. Create a configuration file named `at-events-to-kuma.tf` in the folder:

          {% cut "at-events-to-kuma.tf" %}

          ```hcl
          # Configuring a provider
          
          terraform {
            required_providers {
              yandex    = {
                source  = "yandex-cloud/yandex"
                version = ">= 0.47.0"
              }
            }
          }
          
          provider "yandex" {
            folder_id = var.folder_id
          }
          
          # Declaring variables for custom parameters
          
          variable "folder_id" {
            type = string
          }
          
          variable "vm_user" {
            type = string
          }
          
          variable "ssh_key_path" {
            type = string
          }
          
          variable "bucket_name" {
            type = string
          }
          
          variable "object_prefix" {
            type = string
          }
          
          # Adding other variables
          
          locals {
            sa_bucket_name = "kuma-bucket-sa"
            sa_trail_name  = "kuma-trail-sa"
            sym_key_name   = "kuma-key"
            trail_name     = "kuma-trail"
            zone           = "ru-central1-b"
            network_name   = "kuma-network"
            subnet_name    = "kuma-network-ru-central1-b"
            vm_name        = "kuma-server"
            image_id       = "fd8ulbhv5dpakf3io1mf"
          }
          
          # Creating service accounts
          
          resource "yandex_iam_service_account" "sa-bucket" {
            name        = local.sa_bucket_name
            folder_id   = "${var.folder_id}"
          }
          
          resource "yandex_iam_service_account" "sa-trail" {
            name        = local.sa_trail_name
            folder_id   = "${var.folder_id}"
          }
          
          # Creating a static access key
          
          resource "yandex_iam_service_account_static_access_key" "sa-bucket-static-key" {
            service_account_id = yandex_iam_service_account.sa-bucket.id
          }
          
          output "access_key" {
            value = yandex_iam_service_account_static_access_key.sa-bucket-static-key.access_key
            sensitive = true
          }
          
          output "secret_key" {
            value = yandex_iam_service_account_static_access_key.sa-bucket-static-key.secret_key
            sensitive = true
          }
          
          # Creating a symmetric encryption key
          
          resource "yandex_kms_symmetric_key" "sym_key" {
            name              = local.sym_key_name
            default_algorithm = "AES_256"
          }
          
          # Assigning roles to service accounts
          
          resource "yandex_resourcemanager_folder_iam_member" "sa-bucket-storage-viewer" {
            folder_id   = "${var.folder_id}"
            role        = "storage.admin"
            member      = "serviceAccount:${yandex_iam_service_account.sa-bucket.id}"
          }
          
          resource "yandex_resourcemanager_folder_iam_member" "sa-trail-storage-uploader" {
            folder_id   = "${var.folder_id}"
            role        = "storage.uploader"
            member      = "serviceAccount:${yandex_iam_service_account.sa-trail.id}"
          }
          
          resource "yandex_resourcemanager_folder_iam_member" "sa-trail-at-viewer" {
            folder_id   = "${var.folder_id}"
            role        = "audit-trails.admin"
            member      = "serviceAccount:${yandex_iam_service_account.sa-trail.id}"
          }
          
          resource "yandex_kms_symmetric_key_iam_binding" "encrypter-decrypter" {
            symmetric_key_id = "${yandex_kms_symmetric_key.sym_key.id}"
            role             = "kms.keys.encrypterDecrypter"
            members          = [
              "serviceAccount:${yandex_iam_service_account.sa-bucket.id}","serviceAccount:${yandex_iam_service_account.sa-trail.id}"
            ]
          }
          
          # Creating a bucket
          
          resource "yandex_storage_bucket" "kuma-bucket" {
            folder_id = "${var.folder_id}"
            bucket                = "${var.bucket_name}"
            default_storage_class = "standard"
            anonymous_access_flags {
              read        = false
              list        = false
              config_read = false
            }
          
            server_side_encryption_configuration {
              rule {
                apply_server_side_encryption_by_default {
                  kms_master_key_id = "${yandex_kms_symmetric_key.sym_key.id}"
                  sse_algorithm     = "aws:kms"
                }
              }
            }
          }
          
          # Creating a trail
          
          resource "yandex_audit_trails_trail" "kuma-trail" {
            depends_on         = [yandex_storage_bucket.kuma-bucket, yandex_resourcemanager_folder_iam_member.sa-trail-at-viewer, yandex_resourcemanager_folder_iam_member.sa-trail-storage-uploader]
            name               = local.trail_name
            folder_id          = "${var.folder_id}"
            service_account_id = "${yandex_iam_service_account.sa-trail.id}"
            storage_destination {
              bucket_name   = "${var.bucket_name}"
              object_prefix = "${var.object_prefix}"
            }
            filtering_policy {
              management_events_filter {
                resource_scope {
                  resource_id   = "${var.folder_id}"
                  resource_type = "resource-manager.folder"
                }
              }
            }
          }
          
          # Creating a cloud network and a subnet
          
          resource "yandex_vpc_network" "kuma-network" {
            name = local.network_name
          }
          
          resource "yandex_vpc_subnet" "kuma-network-subnet-b" {
            name           = local.subnet_name
            zone           = local.zone
            v4_cidr_blocks = ["10.1.0.0/24"]
            network_id     = yandex_vpc_network.kuma-network.id
          }
          
          # Creating a VM instance
          
          resource "yandex_compute_disk" "boot-disk" {
            name     = "bootvmdisk"
            type     = "network-hdd"
            zone     = local.zone
            size     = "20"
            image_id = local.image_id
          }
          
          resource "yandex_compute_instance" "kuma-vm" {
            name               = local.vm_name
            platform_id        = "standard-v3"
            zone               = local.zone
          
            resources {
              cores         = 2
              memory        = 2
              core_fraction = 20
            }
          
            boot_disk {
              disk_id = yandex_compute_disk.boot-disk.id
            }
          
            network_interface {
              subnet_id          = yandex_vpc_subnet.kuma-network-subnet-b.id
              nat                = true
            }
          
            metadata = {
              user-data = "#cloud-config\nusers:\n  - name: ${var.vm_user}\n    groups: sudo\n    shell: /bin/bash\n    sudo: 'ALL=(ALL) NOPASSWD:ALL'\n    ssh_authorized_keys:\n      - ${file("${var.ssh_key_path}")}"
            }
          }
          ```

          {% endcut %}

      1. In the directory, create a user data file named `at-events-to-kuma.auto.tfvars`:

          {% cut "at-events-to-kuma.auto.tfvars" %}

          ```hcl
          folder_id          = "<folder_ID>"
          vm_user            = "<instance_username>"
          ssh_key_path       = "<path_to_public_SSH_key>"
          bucket_name        = "<bucket_name>"
          object_prefix      = "<prefix>"
          ```

          {% endcut %}

    {% endlist %}

    For more information on the properties of Terraform resources, see these provider guides:

    * [Service account](../../../iam/concepts/users/service-accounts.md): [yandex_iam_service_account](../../../terraform/resources/iam_service_account.md)
    * [Static access key](../../../iam/concepts/authorization/access-key.md): [yandex_iam_service_account_static_access_key](../../../terraform/resources/iam_service_account_static_access_key.md)
    * [Symmetric encryption key](../../../kms/concepts/key.md): [yandex_kms_symmetric_key](../../../terraform/resources/kms_symmetric_key.md)
    * [Role](../../../iam/concepts/access-control/roles.md): [yandex_resourcemanager_folder_iam_member](../../../terraform/resources/resourcemanager_folder_iam_member.md)
    * [Bucket](../../../storage/concepts/bucket.md): [yandex_storage_bucket](../../../terraform/resources/storage_bucket.md)
    * [Trail](../../concepts/trail.md): [yandex_audit_trails_trail](../../../terraform/resources/audit_trails_trail.md)
    * [Network](../../../vpc/concepts/network.md#network): [yandex_vpc_network](../../../terraform/resources/vpc_network.md)
    * [Subnet](../../../vpc/concepts/network.md#subnet): [yandex_vpc_subnet](../../../terraform/resources/vpc_subnet.md)
    * [Disk](../../../compute/concepts/disk.md): [yandex_compute_disk](../../../terraform/resources/compute_disk.md)
    * [VM](../../../compute/concepts/vm.md): [yandex_compute_instance](../../../terraform/resources/compute_instance.md)

1. In the `at-events-to-kuma.auto.tfvars` file, set the following user-defined properties:

    * `folder_id`: [Folder ID](../../../resource-manager/operations/folder/get-id.md).
    * `vm_user`: Username of the user you are going to create on the VM, e.g., `yc-user`.

        {% note alert %}
        
        Do not use `root` or other reserved usernames. To perform operations requiring root privileges, use the `sudo` command.
        
        {% endnote %}

    * `ssh_key_path`: Path to the public SSH key file and its name, e.g., `~/.ssh/id_ed25519.pub`. You need to [create](../../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) a pair of SSH keys for SSH connection to the VM by yourself.
    * `bucket_name`: [Name of the bucket](../../../storage/concepts/bucket.md#naming) to upload audit logs to, e.g., `my-audit-logs-for-kuma`.

        {% note info %}
        
        The bucket name must be unique across Object Storage. You cannot create two buckets with the same name – even in different folders of different clouds.
        
        {% endnote %}

    * `object_prefix`: [Prefix](../../../storage/concepts/object.md#folder) that will be added to the names of the audit log objects in the bucket, e.g., `/`. The prefix forms a part of the [full name](../../concepts/format.md#log-file-name) of the audit log file. 

1. Create the resources:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

1. Get the [key ID](../../../iam/concepts/authorization/access-key.md#key-id) and [secret key](../../../iam/concepts/authorization/access-key.md#private-key) (you will need them later when mounting the bucket on the server):

    ```hcl
    terraform output access_key
    terraform output secret_key
    ```

    Result:

    ```text
    "YCAJE0tO1Q4zO7bW4********"
    "YCNpH34y9fzL6xEap3wkuxYfkc1PTNvr********"
    ```

Once the infrastructure is created, [mount the bucket on a server](#mount-bucket) and [set up the KUMA collector](#setup-collector).


## Mount the bucket on a server {#mount-bucket}

Perform this action on the server you are going to install the KUMA collector on. As a server, you can use a Compute Cloud VM or your own hardware. In this tutorial, we use the previously created Compute Cloud VM.

1. [Connect](../../../compute/operations/vm-connect/ssh.md#vm-connect) to the server over SSH.
1. Create a new user named `kuma`:

    ```bash
    sudo useradd kuma
    ```

1. Create the `kuma` user's home directory:

    ```bash
    sudo mkdir /home/kuma
    ```

1. Create a file with a static access key and grant permissions for it to the `kuma` user:

    ```bash
    sudo bash -c 'echo <access_key_ID>:<secret_access_key> > /home/kuma/.passwd-s3fs'
    sudo chmod 600 /home/kuma/.passwd-s3fs
    sudo chown -R kuma:kuma /home/kuma
    ```

    Where `<access_key_ID>` and `<secret_access_key>` are the previously saved values ​​of the static access key of the `kuma-bucket-sa` service account.

1. Install the [s3fs](https://github.com/s3fs-fuse/s3fs-fuse) package:

    ```bash
    sudo apt install s3fs
    ````

1. Create a directory that will serve as a mount point for the bucket and grant permissions for it to the `kuma` user:

    ```bash
    sudo mkdir /var/log/yandex-cloud/
    sudo chown kuma:kuma /var/log/yandex-cloud/
    ```

1. Mount the bucket you created earlier by specifying its name:

    ```bash
    sudo s3fs <bucket_name> /var/log/yandex-cloud \
      -o passwd_file=/home/kuma/.passwd-s3fs \
      -o url=https://storage.yandexcloud.net \
      -o use_path_request_style \
      -o uid=$(id -u kuma) \
      -o gid=$(id -g kuma)
    ```

    You can configure automatic mounting of the bucket at operating system start-up by opening the `/etc/fstab` file (`sudo nano /etc/fstab` command) and adding the following line to it:

    ```text
    s3fs#<bucket_name> /var/log/yandex-cloud fuse _netdev,uid=<kuma_uid>,gid=<kuma_gid>,use_path_request_style,url=https://storage.yandexcloud.net,passwd_file=/home/kuma/.passwd-s3fs 0 0
    ```

    Where:

    * `<bucket_name>`: Name of the bucket you created earlier, e.g., `my-audit-logs-for-kuma`.
    * `<kuma_uid>`: `kuma` user ID in the VM operating system.
    * `<kuma_gid>`: `kuma` user group ID in the VM operating system.

        To learn `<kuma_uid>` and `<kuma_gid>`, run the `id kuma` command in the terminal.

1. Make certain that the bucket is mounted:

    ```bash
    sudo ls /var/log/yandex-cloud/
    ```

    If everything is configured correctly, the command will return the current contents of the audit event bucket.

The Yandex Cloud event transfer setup is complete. The events will reside in [JSON](https://en.wikipedia.org/wiki/JSON) files located at:

```text
/var/log/yandex-cloud/{audit_trail_id}/{year}/{month}/{day}/*.json
```


## Configure the KUMA collector {#setup-collector}

For this step, you will need the distribution and license files included with KUMA. Use them to install and configure the collector in the KUMA network infrastructure. For more information, see [this guide](https://support.kaspersky.com/help/KUMA/3.2/en-US/220708.htm).

Once the setup is successfully completed, audit events will start being delivered to KUMA. The KUMA web interface allows you to [search for related events](https://support.kaspersky.com/help/KUMA/3.2/en-US/217989.htm).


## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. Open the `at-events-to-kuma.tf` file and delete your infrastructure description from it.
1. [Delete](../../../storage/operations/objects/delete-all.md) all objects from the bucket you created earlier. Otherwise, the bucket and some of the infrastructure will not be deleted, and the `terraform apply` command will terminate with an error.
1. Apply the changes:

    1. In the terminal, navigate to the configuration file directory.
    1. Make sure the configuration is correct using this command:
    
       ```bash
       terraform validate
       ```
    
       If the configuration is valid, you will get this message:
    
       ```bash
       Success! The configuration is valid.
       ```
    
    1. Run this command:
    
       ```bash
       terraform plan
       ```
    
       You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
    1. Apply the configuration changes:
    
       ```bash
       terraform apply
       ```
    
    1. Type `yes` and press **Enter** to confirm the changes.

#### Useful links {#see-also}

* [Uploading audit logs to KUMA SIEM using the management console, CLI, or API](console.md)