> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization failures alarm remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the console steps to enable an “Authorization Failures” alarm in CloudWatch based on CloudTrail logs.

        ### Prerequisites

        * You already have an AWS CloudTrail trail sending events to a CloudWatch Logs log group.

        ***

        ## 1. Confirm / Set CloudTrail Log Group

        1. In the AWS Console, go to **CloudTrail**.
        2. In the left menu, choose **Trails**.
        3. Click your active trail.
        4. Under **CloudWatch Logs**, confirm:
           * **CloudWatch Logs log group** is set (for example: `/aws/cloudtrail/your-trail`).
           * If not configured:
             * Click **Edit** (or **Configure**).
             * Enable **Send to CloudWatch Logs**.
             * Select / create a **Log group**.
             * Select / create an IAM role if prompted.
             * Save changes and wait a few minutes for logs to start streaming.

        ***

        ## 2. Create a Metric Filter for Authorization Failures

        1. Go to **CloudWatch** in the console.

        2. In the left menu, select **Logs → Log groups**.

        3. Click the CloudTrail log group (e.g., `/aws/cloudtrail/your-trail`).

        4. Go to the **Metric filters** tab and click **Create metric filter**.

        5. In **Filter pattern**, use a pattern that matches authorization errors, for example:

           ```text theme={null}
           { ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") }
           ```

        6. Click **Next**.

        7. For **Assign metric**, fill in:
           * **Filter name**: `AuthorizationFailuresFilter`
           * **Metric namespace**: `CIS/CloudTrail` (or any custom namespace)
           * **Metric name**: `AuthorizationFailures`
           * **Metric value**: `1`
           * **Default value** (optional): `0`

        8. Click **Next**, then **Create metric filter**.

        ***

        ## 3. Create a CloudWatch Alarm on the Metric

        1. Still in **CloudWatch**, go to **Alarms → All alarms**.
        2. Click **Create alarm**.
        3. Click **Select metric**.
        4. Navigate to **Custom namespaces** → your namespace (e.g., `CIS/CloudTrail`) → select the `AuthorizationFailures` metric.
        5. Click **Select metric**.
        6. Set **Statistic** to `Sum` and choose a **Period** (e.g., `5 minutes`).
        7. Define the condition:
           * **Threshold type**: Static
           * **Whenever Sum is**: `Greater than`
           * **Threshold**: `0`
        8. Click **Next**.

        ***

        ## 4. Configure Notification (SNS)

        1. In the **Notification** section:
           * Under **Alarm state trigger**, select **In alarm**.
           * Choose an existing **SNS topic** or click **Create new topic**.
           * If creating a new topic:
             * Provide a name (e.g., `AuthorizationFailuresTopic`).
             * Enter one or more **email** addresses.
           * After creation, confirm subscription from the email(s) you receive.
        2. Click **Next**.

        ***

        ## 5. Name and Create the Alarm

        1. Give the alarm a name and description, for example:
           * Name: `AuthorizationFailuresAlarm`
           * Description: `Alarm when CloudTrail records authorization failures (AccessDenied / UnauthorizedOperation).`
        2. Review all settings.
        3. Click **Create alarm**.

        ***

        Once done, any CloudTrail event that matches the filter (authorization failures) will increment the metric, and if it exceeds the threshold (>0 in the period), the CloudWatch alarm will enter `ALARM` state and trigger your SNS notification.
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, step‑by‑step AWS CLI instructions to set up a CloudWatch alarm for authorization failures (e.g., `AuthorizationFailure`, `AccessDenied`) from CloudTrail logs.

        Assumptions:

        * You already have CloudTrail sending logs to a CloudWatch Logs log group.
        * Replace all ALL\_CAPS placeholders with your values.

        ***

        ### 1. Identify your CloudTrail log group

        If you don’t know it:

        ```bash theme={null}
        aws logs describe-log-groups --query "logGroups[].logGroupName"
        ```

        Pick the CloudTrail log group name, for example:
        `/aws/cloudtrail/your-account-trails`

        Set it in a variable (optional but convenient):

        ```bash theme={null}
        LOG_GROUP_NAME="/aws/cloudtrail/your-account-trails"
        ```

        ***

        ### 2. Create a metric filter for authorization failures

        Filter pattern to catch common authorization failures:

        ```bash theme={null}
        FILTER_NAME="AuthorizationFailures"
        METRIC_NAMESPACE="SecurityMetrics"
        METRIC_NAME="AuthorizationFailuresCount"

        aws logs put-metric-filter \
          --log-group-name "$LOG_GROUP_NAME" \
          --filter-name "$FILTER_NAME" \
          --filter-pattern '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") || ($.errorCode = "AuthorizationFailure") }' \
          --metric-transformations \
              metricName="$METRIC_NAME",metricNamespace="$METRIC_NAMESPACE",metricValue=1
        ```

        Verify:

        ```bash theme={null}
        aws logs describe-metric-filters \
          --log-group-name "$LOG_GROUP_NAME" \
          --filter-name-prefix "$FILTER_NAME"
        ```

        ***

        ### 3. Create/choose an SNS topic for the alarm notification

        Create topic:

        ```bash theme={null}
        SNS_TOPIC_ARN=$(aws sns create-topic --name security-authorization-failures --query 'TopicArn' --output text)
        ```

        Subscribe your email (or another endpoint):

        ```bash theme={null}
        aws sns subscribe \
          --topic-arn "$SNS_TOPIC_ARN" \
          --protocol email \
          --notification-endpoint YOUR_EMAIL@example.com
        ```

        Confirm the subscription from your email inbox.

        ***

        ### 4. Create the CloudWatch alarm on the metric

        Example: alarm if ≥ 1 authorization failure in 5 minutes.

        ```bash theme={null}
        ALARM_NAME="AuthorizationFailuresAlarm"

        aws cloudwatch put-metric-alarm \
          --alarm-name "$ALARM_NAME" \
          --alarm-description "Alarm when AWS CloudTrail logs record authorization failures" \
          --namespace "$METRIC_NAMESPACE" \
          --metric-name "$METRIC_NAME" \
          --statistic Sum \
          --period 300 \
          --evaluation-periods 1 \
          --threshold 1 \
          --comparison-operator GreaterThanOrEqualToThreshold \
          --treat-missing-data notBreaching \
          --alarm-actions "$SNS_TOPIC_ARN"
        ```

        Check the alarm:

        ```bash theme={null}
        aws cloudwatch describe-alarms --alarm-names "$ALARM_NAME"
        ```

        ***

        ### 5. Test the alarm (optional)

        * Intentionally perform an AWS action your IAM user/role is not allowed to do (in a safe, non‑prod way).
        * Wait a few minutes; the alarm should go into `ALARM` state and send an SNS notification.

        This completes enabling an “Authorization Failures” alarm using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below are step‑by‑step remediation instructions and example Python (boto3) code to ensure an “Authorization Failures” alarm is enabled in AWS using CloudWatch.

        Assumptions:

        * You have:
          * A CloudTrail trail logging to a CloudWatch Logs log group (e.g. `/aws/cloudtrail/logs`)
          * An IAM principal with permissions for `logs:*`, `cloudwatch:*`, `iam:*`, and `cloudtrail:*`.

        ***

        ## 1. Decide what to alarm on

        Common pattern: alarm on CloudTrail events where API calls fail with:

        * `errorCode = "AccessDenied*"`
        * OR `errorCode = "UnauthorizedOperation"`

        We’ll:

        1. Create a **CloudWatch Logs Metric Filter** on the CloudTrail log group.
        2. Create a **CloudWatch Alarm** on that metric.
        3. (Optional) Wire it into an SNS topic for notifications.

        ***

        ## 2. Create the CloudWatch Logs Metric Filter (Python)

        This metric filter will increment a metric every time an “authorization failure” is seen.

        ```python theme={null}
        import boto3

        logs_client = boto3.client('logs', region_name='us-east-1')

        LOG_GROUP_NAME = '/aws/cloudtrail/logs'   # replace with your CloudTrail log group
        METRIC_NAMESPACE = 'Security/Authorization'
        METRIC_NAME = 'AuthorizationFailures'
        FILTER_NAME = 'AuthorizationFailuresFilter'

        # Filter pattern for access denied / unauthorized operations from CloudTrail logs
        FILTER_PATTERN = (
            '{ ($.errorCode = "AccessDenied*" || $.errorCode = "UnauthorizedOperation") && '
            '($.eventSource != "signin.amazonaws.com") }'
        )

        def create_metric_filter():
            logs_client.put_metric_filter(
                logGroupName=LOG_GROUP_NAME,
                filterName=FILTER_NAME,
                filterPattern=FILTER_PATTERN,
                metricTransformations=[
                    {
                        'metricName': METRIC_NAME,
                        'metricNamespace': METRIC_NAMESPACE,
                        'metricValue': '1',
                        'defaultValue': 0.0
                    }
                ]
            )
            print(f"Created/updated metric filter '{FILTER_NAME}' on log group '{LOG_GROUP_NAME}'")

        if __name__ == '__main__':
            create_metric_filter()
        ```

        Notes:

        * Adjust `LOG_GROUP_NAME` to your actual CloudTrail CloudWatch Logs group.
        * Adjust `region_name` as needed.

        ***

        ## 3. Create an SNS Topic for Alarm Notifications (optional but recommended)

        ```python theme={null}
        import boto3

        sns_client = boto3.client('sns', region_name='us-east-1')

        TOPIC_NAME = 'AuthorizationFailuresAlarmTopic'
        EMAIL_SUBSCRIPTION = 'you@example.com'  # change to your email

        def create_sns_topic_and_subscription():
            # Create or get SNS topic
            topic_response = sns_client.create_topic(Name=TOPIC_NAME)
            topic_arn = topic_response['TopicArn']
            print(f"SNS topic ARN: {topic_arn}")

            # Subscribe email to topic
            sns_client.subscribe(
                TopicArn=topic_arn,
                Protocol='email',
                Endpoint=EMAIL_SUBSCRIPTION
            )
            print(f"Subscription request sent to {EMAIL_SUBSCRIPTION}. Confirm via email.")

            return topic_arn

        if __name__ == '__main__':
            create_sns_topic_and_subscription()
        ```

        ***

        ## 4. Create the CloudWatch Alarm on This Metric (Python)

        This alarm triggers when more than a certain number of authorization failures occur in a given time window.

        ```python theme={null}
        import boto3

        cloudwatch_client = boto3.client('cloudwatch', region_name='us-east-1')

        METRIC_NAMESPACE = 'Security/Authorization'
        METRIC_NAME = 'AuthorizationFailures'
        ALARM_NAME = 'AuthorizationFailuresAlarm'
        ALARM_DESCRIPTION = 'Alarm when AWS API calls fail due to authorization failures'
        EVALUATION_PERIODS = 1          # number of evaluation periods
        PERIOD = 300                    # 300 seconds = 5 minutes
        THRESHOLD = 1                   # alarm if >= 1 event in the period
        STATISTIC = 'Sum'
        COMPARISON_OPERATOR = 'GreaterThanOrEqualToThreshold'
        SNS_TOPIC_ARN = 'arn:aws:sns:us-east-1:123456789012:AuthorizationFailuresAlarmTopic'  # replace with your ARN

        def create_authorization_failures_alarm():
            cloudwatch_client.put_metric_alarm(
                AlarmName=ALARM_NAME,
                AlarmDescription=ALARM_DESCRIPTION,
                Namespace=METRIC_NAMESPACE,
                MetricName=METRIC_NAME,
                Statistic=STATISTIC,
                Period=PERIOD,
                EvaluationPeriods=EVALUATION_PERIODS,
                Threshold=THRESHOLD,
                ComparisonOperator=COMPARISON_OPERATOR,
                TreatMissingData='notBreaching',
                AlarmActions=[SNS_TOPIC_ARN],   # can be empty list if no action required
                OKActions=[SNS_TOPIC_ARN],      # optional: notify when alarm returns to OK
                ActionsEnabled=True
            )
            print(f"Created/updated CloudWatch alarm '{ALARM_NAME}'")

        if __name__ == '__main__':
            create_authorization_failures_alarm()
        ```

        Adjust:

        * `SNS_TOPIC_ARN` to the ARN from step 3 or omit `AlarmActions` if you don’t want notifications.
        * `THRESHOLD`, `PERIOD`, `EVALUATION_PERIODS` based on your sensitivity to alerts.

        ***

        ## 5. Verify the Alarm

        1. In the AWS Console:
           * Go to **CloudWatch → Logs → Log groups**: confirm the metric filter exists.
           * Go to **CloudWatch → Metrics → Security/Authorization**: confirm the metric is visible after some denied API calls.
           * Go to **CloudWatch → Alarms**: verify `AuthorizationFailuresAlarm` is `OK` and configured with the correct metric and SNS action.

        2. Generate a test authorization failure (e.g., call an API without required permissions) and confirm:
           * Metric increments.
           * Alarm moves to `ALARM` state when threshold is crossed.
           * Notification is sent (if SNS configured).

        ***

        If you tell me:

        * Your region
        * Your CloudTrail log group name
          I can adapt the code snippets exactly to your environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # CloudTrail log group that receives your CloudTrail events
        # Replace LOG_GROUP_NAME with your actual CloudTrail CloudWatch Logs group name
        resource "aws_cloudwatch_log_group" "cloudtrail" {
          name = "CLOUDTRAIL_LOG_GROUP_NAME" # <-- replace with your log group name
        }

        # Metric filter for authorization failures (UnauthorizedOperation / AccessDenied*)
        resource "aws_cloudwatch_log_metric_filter" "authorization_failures" {
          name           = "AuthorizationFailuresFilter"
          log_group_name = aws_cloudwatch_log_group.cloudtrail.name

          # Matches the verified CLI filter-pattern exactly
          pattern = "{($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\")}"

          metric_transformation {
            name      = "AuthorizationFailures"
            namespace = "CloudTrailMetrics"
            value     = "1"
          }
        }

        # CloudWatch alarm on the metric created by the filter
        resource "aws_cloudwatch_metric_alarm" "authorization_failures" {
          alarm_name        = "AuthorizationFailuresAlarm"
          alarm_description = "Triggers when 3 or more API authorization failures are detected in 5 minutes"

          namespace = aws_cloudwatch_log_metric_filter.authorization_failures.metric_transformation[0].namespace
          metric_name = aws_cloudwatch_log_metric_filter.authorization_failures.metric_transformation[0].name

          statistic           = "Sum"
          period              = 300
          threshold           = 3
          comparison_operator = "GreaterThanOrEqualToThreshold"
          evaluation_periods  = 1

          alarm_actions = [
            "SNS_TOPIC_ARN", # <-- replace with your SNS topic ARN for notifications
          ]

          depends_on = [
            aws_cloudwatch_log_metric_filter.authorization_failures,
          ]
        }
        ```

        Running `terraform plan` should show creation of `aws_cloudwatch_log_metric_filter.authorization_failures` and `aws_cloudwatch_metric_alarm.authorization_failures` (and the log group if it is not already managed in Terraform), with the metric name, namespace, pattern, threshold, period, and alarm name matching the CLI remediation.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>