AWS Config Changes Alarm
More Info:
AWS Config configuration changes should be monitored using CloudWatch alarms.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, AWSWAF, HITRUST, CISAWSF, PCI, GDPR, APRA, MAS, NISTCSF, CBP, NIST4Triage and Remediation
Remediation
Using Console
Using Console
AWS Config Changes Alarm is triggered when certain critical changes are made to the AWS Config settings. To ensure compliance, follow these steps to create a CloudWatch alarm to monitor AWS Config changes:
- Sign in to the AWS Management Console.
- Navigate to the CloudWatch dashboard at: https://console.aws.amazon.com/cloudwatch/.
- In the left navigation panel, select Logs.
- Select the log group created for your CloudTrail event logs and click Create Metric Filter.
- On the Define Logs Metric Filter page, enter the following pattern in the Filter Pattern box:
- Review the metric filter configuration and click Assign Metric.
-
On the Create Metric Filter and Assign a Metric page:
- In the Filter Name box, enter a unique name like
AWSConfigChanges. - In the Metric Namespace box, type
CloudTrailMetrics. - In the Metric Name box, type
ConfigEventCount. - Click Show advanced metric settings, then enter
1in the Metric Value box.
- In the Filter Name box, enter a unique name like
- Review the details and click Create Filter to generate the metric filter.
- On the next page, click Create Alarm.
-
In the Create Alarm dialog box:
- Provide a unique name and short description for the alarm.
- Under Whenever: Metric Name, select
>=from the dropdown and enter1as the threshold value. - Under Actions, click the
+ Notificationbutton and choose the SNS topic for alarm notifications. - Set the Period to
5 Minutesand Statistic toSum.
- Review the configuration and click Create Alarm. Once created, the alarm will be listed on the Alarms page.
Using CLI
Using CLI
The AWS Config Changes Alarm checks for specific configuration changes within your AWS account and triggers alerts. You can use the following AWS CLI commands to create the necessary metric filter and alarm:Note: Replace
- Run the following command to create a CloudWatch metric filter and associate it with the appropriate CloudTrail log group:
- Run the following command to create the CloudWatch alarm:
- If the rule is non-compliant, create an alarm for AWS Config changes using the AWS CLI:
<your-SNS-topic-ARN> with the ARN of the SNS topic you want to receive the alarm notifications.- Once completed, verify the alarm setup by listing the alarms:
- Finally, check whether the
AWS Config Changes Alarmis triggered and working as expected:
Using Python
Using Python
You can also automate the monitoring of AWS Config changes by setting up a Python-based Lambda function that triggers based on a CloudWatch alarm. Here’s an example:
- Create an AWS Lambda function and use Python 3.x as the runtime.
- Assign the necessary AWS Config trigger permissions to the Lambda function.
- Use the following Python code to monitor and act on configuration changes:
- Test and deploy the Lambda function. Ensure that the necessary permissions and triggers are configured correctly.