AWS Console setup for SIEM integration

​

Overview

​

Use cases

• Set up SIEM integration without using infrastructure-as-code tools
• Quick proof-of-concept or testing environment setup
• Organizations that prefer GUI-based configuration
• One-time deployment where Terraform automation isn’t needed

​

Prerequisites

• AWS account with console access
• Permissions to create IAM roles, policies, and Kinesis streams
• Basic familiarity with AWS Console navigation
• Screenshot callout: Verify you can access both the Kinesis and IAM services in the AWS Console

​

Setup

1. Log in to the AWS Management Console
2. Determine which AWS region you want to use for your Kinesis stream
3. Generate a secure external ID for IAM role assumption

​

Generate external ID

1. Open a terminal or command prompt
2. Run the following command to generate a secure random string:

openssl rand -hex 32

3. Save this value securely (you’ll need it multiple times during setup)
4. Example output: 9167190a4095f18bb33c84d75f9596366ee0cd392332e72f130f66da38c320d3

​

How-to

​

Create Kinesis Data Stream

1. Navigate to the AWS Kinesis service in the console
2. Click Data streams in the left sidebar
3. Click Create data stream

4. Configure the data stream:
   • Data stream name: Enter a descriptive name (e.g., meter-siem-events)
   • Capacity mode: Select Provisioned
   • Provisioned shards: Enter 1 (suitable for most deployments)

5. Expand Data stream configuration (optional settings):
   • Data retention period: Leave at default 24 hours or adjust based on your needs
   • Encryption: Enable if required for compliance
6. Click Create data stream
7. Wait for the stream status to change to Active (this takes 1-2 minutes)

8. Copy the ARN from the data stream details page
   • Format: arn:aws:kinesis:us-east-1:123456789012:stream/meter-siem-events
   • Save this ARN for later use in Meter Dashboard

​

Create IAM policy for Kinesis write access

9. Navigate to the IAM service in the console
10. Click Policies in the left sidebar
11. Click Create policy

12. Select the JSON tab
13. Replace the default policy with the following (update the Resource ARN with your Kinesis stream ARN):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kinesis:PutRecord",
        "kinesis:PutRecords"
      ],
      "Resource": "arn:aws:kinesis:us-east-1:123456789012:stream/meter-siem-events"
    }
  ]
}

14. Click Next
15. Configure policy details:
    • Policy name: Enter MeterSIEMKinesisWritePolicy
    • Description: Enter Allows Meter to write security events to Kinesis stream

16. Click Create policy

​

Create IAM role for Meter

17. In the IAM console, click Roles in the left sidebar
18. Click Create role

19. Configure trusted entity:
    • Trusted entity type: Select AWS account
    • An AWS account: Select Another AWS account
    • Account ID: Enter 458553032353 (Meter’s AWS account)
    • Options: Check Require external ID
    • External ID: Enter the external ID you generated earlier

20. Click Next
21. Attach permissions policy:
    • Search for MeterSIEMKinesisWritePolicy (the policy you created earlier)
    • Check the box next to the policy

22. Click Next
23. Configure role details:
    • Role name: Enter MeterSIEMIntegrationRole
    • Description: Enter Allows Meter to publish security events to Kinesis

24. Review the configuration and click Create role
25. Find your newly created role in the roles list and click on it
26. Copy the ARN from the role summary
    • Format: arn:aws:iam::123456789012:role/MeterSIEMIntegrationRole
    • Save this ARN for use in Meter Dashboard

​

Verify trust policy

27. In the role details page, click the Trust relationships tab
28. Click Edit trust policy

29. Verify the trust policy matches this format (your external ID will be different):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::458553032353:role/Meter-data-export"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "9167190a4095f18bb33c84d75f9596366ee0cd392332e72f130f66da38c320d3"
        }
      }
    }
  ]
}

30. If everything looks correct, click Cancel (no changes needed)

​

Configure in Meter Dashboard

31. You now have all three required values:
    • AWS Kinesis ARN: From step 8
    • Role ARN: From step 26
    • External ID: From step 2
32. Navigate to Meter Dashboard and follow the Configuring SIEM integration guide to complete the setup
33. Use the Send test event feature in Dashboard to verify the configuration

​

Configuration reference

​

Kinesis Data Stream settings

​

IAM Policy permissions

​

IAM Role trust policy

​

Best practices

​

Monitoring

• Enable CloudWatch metrics: In the Kinesis stream settings, ensure shard-level metrics are enabled for IncomingBytes and IncomingRecords
• Set up alarms: Create CloudWatch alarms to alert when no events are received for 10+ minutes
• Monitor costs: Track Kinesis stream costs in AWS Cost Explorer, especially if you increase shard count

​

Operational

• Document your setup: Save the Kinesis ARN, Role ARN, and External ID in your password manager or documentation system
• Tag resources: Add tags to your Kinesis stream and IAM role for cost tracking (e.g., Environment: Production, ManagedBy: Security Team)
• Test regularly: Send test events from Meter Dashboard after any AWS configuration changes

​

Performance optimization

• Right-size shards: Monitor the WriteProvisionedThroughputExceeded metric; if you see throttling, increase the shard count
• Adjust retention: If you only process events in real-time, consider reducing retention to 24 hours to save costs
• Consider on-demand mode: For variable or unpredictable workloads, switch to on-demand capacity mode

​

Troubleshooting

​

Kinesis stream not appearing in AWS Console

• Check the region selector in the top-right corner of the AWS Console
• Switch to the region where you created the stream
• Kinesis streams are region-specific resources

​

IAM role creation fails with “Invalid principal”

• Verify you entered 458553032353 exactly as shown
• Ensure there are no extra spaces or characters
• The account ID is 12 digits

​

”Unauthorized” error in Meter Dashboard

• Verify the external ID in the IAM trust policy exactly matches what you entered in Dashboard
• Check that the Principal ARN is arn:aws:iam::458553032353:role/Meter-data-export
• Ensure the IAM policy is attached to the role (check the Permissions tab)
• Verify the Kinesis stream ARN in the policy matches your actual stream

​

Cannot find the IAM policy when creating the role

• Go back to IAM > Policies and verify MeterSIEMKinesisWritePolicy exists
• If missing, recreate the policy following steps 9-16
• When attaching policies, use the search box to filter by name

​

High AWS costs

• Review your actual event volume in CloudWatch metrics
• If IncomingBytes is consistently low, reduce shard count to 1
• Consider reducing data retention period from 24 hours to a shorter period
• Switch to on-demand mode if your workload is unpredictable

​

Related resources

• Configuring SIEM integration in Dashboard
• SIEM integration technical overview
• Terraform configuration examples
• AWS Kinesis Data Streams Console documentation
• AWS IAM roles documentation

​

Need help?