HCA Log Archival — IaC Deployment Plan

Phase 1 — Foundation

Bucket naming standard has been set to follow the pattern hca-archival-usw2-<source>. This follows kebab-case source token, no account ID as all buckets are in the same Log Archival account.

• Current trail inventory (per source doc §2.9) shows no digest validation column populated for any trail. Confirm this is actually off today before treating it as a change.
• Create 6 new S3 buckets, namely:
  • hca-archival-usw2-vpc-flow
  • hca-archival-usw2-tgw-flow
  • hca-archival-usw2-guardduty
  • hca-archival-usw2-waf
  • hca-archival-usw2-route53
  • hca-archival-usw2-elb
• Enable these on each bucket: delete-deny bucket policy, Object Lock (compliance mode), SSE-KMS, versioning, lifecycle rule (S3 Standard to Glacier Flexible Retrieval at 90 days, expire at 366 days).
• No need to rename existing buckets for CloudTrail/Config as both are already centralized in aws-controltower-logs-095509168441-us-west-2 (Control Tower managed).
• Enable log file integrity validation (digest files) on CloudTrail trails not currently covered by Control Tower defaults.

Phase 2 — VPC Flow, TGW, Route 53 second-feed delivery

• Add a second VPC Flow Log delivery, targeting hca-archival-usw2-vpc-flow, on all VPCs currently logging to CloudWatch. Existing CloudWatch flow log groups are left untouched.
• Add a second Transit Gateway Flow Log delivery, targeting hca-archival-usw2-tgw-flow. Existing HCA-TGW-LogGroup is left untouched.
• Stand up a new Route 53 Resolver query logging config, targeting hca-archival-usw2-route53.
  • Note: current Route 53 configs (dns-poc-logs, LogGroup_NewDev) are POC/Dev-labeled in the source doc. Decide whether this new config replaces or productionizes those two, or stands up alongside them.
• No changes to existing CloudWatch feeds or any alerting built on them in this phase.

Phase 3 — GuardDuty findings export + WAF S3 delivery

• Enable GuardDuty publishing destination on each account (HCA-Non-Prod-Dev, HCA-Non-Prod-QA, HCA-Prod, HCA-Non-Prod), targeting hca-archival-usw2-guardduty, with a KMS key policy allowing GuardDuty write access.
  • Note: this covers S3-side retention only. The live CloudWatch log group (/aws/guardduty/malware-scan-events) stays at 3-month retention, with no change to that in this phase per current direction.
• Stand up a CloudWatch subscription filter to Lambda to S3 delivery path for WAF logs, targeting hca-archival-usw2-waf. Existing CloudWatch feed (aws-waf-logs-step-cognito-userpool) stays live and untouched.

Phase 4 — ALB access log repoint

• Repoint access logs on prod-mobileapp-alb and HCA-PROD-Step-Tool-ALB from their current local S3 destinations to hca-archival-usw2-elb.
• Current buckets prod-mobileapp-alb-logs and step-alb-access-logs are left as-is. New logs land in hca-archival-usw2-elb, and old buckets are not touched or cleaned up by this plan.
• Sequence as its own change window, since this touches production load balancers directly.

Phase 5 — NLB access logging (new capability)

• Enable TLS listener access logging, targeting hca-archival-usw2-elb, on the 5 currently-unlogged production NLBs: NLB-SASVIYA-TO-PROD-SMTP, NLB-Redshift-serverless-PROD, NLB-SASVIYA-TO-PROD-DB, mobile-api-nlb, HCA-PROD-Step-Tool-NLB.
  • Note: this is net-new capability enablement, not a repoint. Confirm listener types on each NLB actually support access logging before rollout, since there is no existing config to fall back on if something is unsupported.
• Prove out the config on one NLB before rolling to all 5, given no existing logging baseline to compare against on failure.

Phase 6 — Guardrails

• Enforce, per log source, that deployments are blocked when the corresponding logging/export config is absent, disabled, or points to a non-approved destination.
• Sources covered: AWS Config, CloudTrail, VPC Flow Logs, TGW Flow Logs, ELB/ALB access logging, Route 53 Resolver query logging, AWS WAF, GuardDuty. Each source's approved destination is the corresponding hca-archival-usw2-<source> bucket, or the existing Control Tower bucket for Config/CloudTrail.
• Sequence last, since this depends on bucket names being live and the delivery paths from Phases 1 through 5 being proven in production.