Skip to main content

AWS Config Changes Alarm Should Be Enabled

More Info:​

AWS Config configuration changes should be monitored using CloudWatch alarms.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HITRUST CSF
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below is how to set up an AWS Config changes alarm in CloudWatch using only the AWS Management Console. This follows the common CIS-style pattern: CloudTrail → CloudWatch Logs → Metric Filter → Alarm.

Prerequisites (quick checks)​

  1. CloudTrail is enabled and recording management events.
  2. CloudTrail is delivering logs to a CloudWatch Logs log group.

If you already have a CloudTrail trail that sends logs to a CloudWatch Logs log group, skip to Step 2.

Step 1 – (If needed) Send CloudTrail logs to CloudWatch Logs​

  1. In the AWS console, go to CloudTrail.
  2. Click Trails in the left menu.
  3. Select your main trail (or create one if you don’t have it).
  4. In the CloudWatch Logs section:
    • Click Edit (or Configure).
    • Choose an existing log group or create a new one (e.g., /aws/cloudtrail/main).
    • Choose/create an IAM role as prompted.
    • Save the configuration.

Note the CloudWatch Logs log group name; you’ll need it in the next step.

Step 2 – Create a metric filter for AWS Config changes​

  1. Go to CloudWatch in the AWS console.

  2. In the left menu, under Logs, click Log groups.

  3. Click the CloudTrail log group (e.g., /aws/cloudtrail/main).

  4. Go to the Metric filters tab.

  5. Click Create metric filter.

  6. In Filter pattern, paste this filter to catch AWS Config configuration changes:

    { ($.eventSource = "config.amazonaws.com") && 
      (
        $.eventName = "StopConfigurationRecorder" ||
        $.eventName = "DeleteDeliveryChannel"      ||
        $.eventName = "PutConfigurationRecorder"   ||
        $.eventName = "PutDeliveryChannel"         ||
        $.eventName = "PutConfigurationAggregator" ||
        $.eventName = "DeleteConfigurationAggregator" ||
        $.eventName = "PutOrganizationConfigRule"  ||
        $.eventName = "DeleteOrganizationConfigRule" ||
        $.eventName = "PutConfigRule"              ||
        $.eventName = "DeleteConfigRule"
      )
    }

    (You can add/remove event names depending on what you want to monitor.)

  7. Click Next to test the pattern (optional but recommended), then Next.

  8. Under Assign metric:

    • Metric name: AWSConfigChanges
    • Metric namespace: SecurityMonitoring (or any name you prefer)
    • Metric value: 1

  9. Click Next, then Create metric filter.

Step 3 – Create a CloudWatch alarm on the metric​

  1. Still in CloudWatch, in the left menu click Alarms → All alarms.

  2. Click Create alarm.

  3. Click Select metric.

  4. Navigate to the namespace you used above (e.g., SecurityMonitoring).

  5. Select the metric AWSConfigChanges, then click Select metric.

  6. Configure the alarm:

    • Statistic: Sum
    • Period: e.g., 5 minutes
    • Threshold type: Static
    • Condition: Greater/Equal 1
    • Meaning: if at least one AWS Config change event occurs in 5 minutes, the alarm triggers.

  7. Click Next.

  8. Notification:

    • Under Alarm state trigger, ensure In alarm is selected.
    • Choose an existing SNS topic (for email/Slack/etc.) or Create new topic:
      • Enter topic name (e.g., aws-config-changes-alerts).
      • Enter your email address (or other endpoint).
      • After creation, confirm the subscription via the email you receive.

  9. Click Next.

  10. Name and description:

    • Name: AWSConfigChangesAlarm
    • Description: Alarm on AWS Config configuration changes via CloudTrail

  11. Click Next, review, then Create alarm.

Step 4 – (Optional) Test the alarm​

  1. Make a benign AWS Config change (e.g., adjust a Config rule or delivery channel in a test account).
  2. Wait for the CloudWatch period (e.g., 5–10 minutes).
  3. Confirm:
    • The CloudWatch alarm transitions to ALARM.
    • The SNS notification is received (email, etc.).

Once these steps are complete, you have an AWS Config changes alarm enabled in CloudWatch via the AWS console.

Using CLI

Below are end‑to‑end AWS CLI steps to create a CloudWatch alarm for AWS Config changes (using CloudTrail → CloudWatch Logs → metric filter → alarm).

Assumptions:

  • You already have a CloudTrail trail sending events to a CloudWatch Logs log group (e.g., /aws/cloudtrail/logs).
  • You have AWS CLI configured with appropriate permissions.

1. Identify the CloudTrail log group​

If you don’t know the log group, list CloudWatch log groups:

aws logs describe-log-groups

Assume the log group name is:

LOG_GROUP_NAME="/aws/cloudtrail/logs"

2. Create a metric filter for AWS Config changes​

Filter on AWS Config API calls that change the configuration recorder or delivery channel:

aws logs put-metric-filter \
  --log-group-name "$LOG_GROUP_NAME" \
  --filter-name "AWSConfigChangesFilter" \
  --filter-pattern '{ ($.eventSource = "config.amazonaws.com") && ( ($.eventName = "StopConfigurationRecorder") || ($.eventName = "DeleteDeliveryChannel") || ($.eventName = "PutConfigurationRecorder") || ($.eventName = "PutDeliveryChannel") ) }' \
  --metric-transformations \
    metricName="AWSConfigChanges",metricNamespace="Security",metricValue="1"

This will publish a metric Security/AWSConfigChanges with value 1 each time one of those events appears.

3. Create a CloudWatch alarm on the metric​

Create an alarm that triggers if at least 1 such event occurs in a 5‑minute window:

aws cloudwatch put-metric-alarm \
  --alarm-name "AWSConfigChangesAlarm" \
  --alarm-description "Alarm when AWS Config configuration recorder or delivery channel is modified" \
  --metric-name "AWSConfigChanges" \
  --namespace "Security" \
  --statistic "Sum" \
  --period 300 \
  --evaluation-periods 1 \
  --threshold 1 \
  --comparison-operator "GreaterThanOrEqualToThreshold" \
  --treat-missing-data "notBreaching" \
  --alarm-actions "arn:aws:sns:REGION:ACCOUNT_ID:SECURITY-TOPIC"

Replace:

  • REGION with your region (e.g., us-east-1)
  • ACCOUNT_ID with your AWS account ID
  • SECURITY-TOPIC with an existing SNS topic ARN for notifications.

If you don’t have an SNS topic:

aws sns create-topic --name Security-Alerts

Then use the returned TopicArn in --alarm-actions and subscribe your email:

aws sns subscribe \
  --topic-arn "arn:aws:sns:REGION:ACCOUNT_ID:Security-Alerts" \
  --protocol email \
  --notification-endpoint "you@example.com"

Once done, any AWS Config configuration recorder or delivery channel change will generate a CloudTrail event, be picked up by the metric filter, and trigger the CloudWatch alarm, satisfying “AWS Config Changes Alarm Should Be Enabled.”

Using Python

Below is a step‑by‑step approach and example Python (boto3) code to ensure an “AWS Config Changes” alarm exists in CloudWatch. This follows the typical CIS-style requirement: a CloudWatch Logs metric filter on CloudTrail logs for AWS Config changes, plus a CloudWatch alarm on that metric.

1. Prerequisites​

  • You have:
    • A CloudTrail trail delivering logs to a CloudWatch Logs log group (e.g. /aws/cloudtrail/logs).
    • An SNS topic ARN for alarm notifications (e.g. arn:aws:sns:us-east-1:111122223333:SecurityNotifications).
  • Python 3 and boto3 installed.
  • AWS credentials configured (env vars, profile, or instance role).

2. Define the metric filter pattern​

CIS-like pattern for AWS Config configuration recorder changes:

{ ($.eventSource = "config.amazonaws.com") && 
  (($.eventName = "StopConfigurationRecorder") || 
   ($.eventName = "DeleteDeliveryChannel") || 
   ($.eventName = "PutDeliveryChannel") || 
   ($.eventName = "PutConfigurationRecorder")) }

You’ll use this in the CloudWatch Logs metric filter.

3. Python script to create/update metric filter and alarm​

Adjust the variables at the top as needed (region, account ID, log group, SNS topic, metric/alarm names).

import boto3
import botocore

REGION = "us-east-1"
ACCOUNT_ID = "111122223333"
LOG_GROUP_NAME = "/aws/cloudtrail/logs"  # Your CloudTrail log group
METRIC_NAMESPACE = "CIS/CloudTrailMetrics"
METRIC_NAME = "AWSConfigChanges"
FILTER_NAME = "AWSConfigChangesFilter"
ALARM_NAME = "AWSConfigChangesAlarm"
SNS_TOPIC_ARN = "arn:aws:sns:us-east-1:111122223333:SecurityNotifications"

FILTER_PATTERN = (
    '{ ($.eventSource = "config.amazonaws.com") && '
    '( ($.eventName = "StopConfigurationRecorder") || '
    '  ($.eventName = "DeleteDeliveryChannel") || '
    '  ($.eventName = "PutDeliveryChannel") || '
    '  ($.eventName = "PutConfigurationRecorder") ) }'
)

def ensure_metric_filter(logs_client):
    # Create or update metric filter on the CloudTrail log group
    logs_client.put_metric_filter(
        logGroupName=LOG_GROUP_NAME,
        filterName=FILTER_NAME,
        filterPattern=FILTER_PATTERN,
        metricTransformations=[
            {
                "metricName": METRIC_NAME,
                "metricNamespace": METRIC_NAMESPACE,
                "metricValue": "1"
            }
        ]
    )
    print(f"Metric filter '{FILTER_NAME}' ensured on log group '{LOG_GROUP_NAME}'.")

def ensure_alarm(cw_client):
    # Create or update CloudWatch alarm tied to the metric
    cw_client.put_metric_alarm(
        AlarmName=ALARM_NAME,
        AlarmDescription="Alarm when AWS Config recorder or delivery channel is changed",
        Namespace=METRIC_NAMESPACE,
        MetricName=METRIC_NAME,
        Statistic="Sum",
        Period=300,               # 5 minutes
        EvaluationPeriods=1,
        Threshold=1,
        ComparisonOperator="GreaterThanOrEqualToThreshold",
        TreatMissingData="notBreaching",
        ActionsEnabled=True,
        AlarmActions=[SNS_TOPIC_ARN],
        OKActions=[SNS_TOPIC_ARN],
        Dimensions=[
            {
                "Name": "AccountId",
                "Value": ACCOUNT_ID
            }
        ]
    )
    print(f"Alarm '{ALARM_NAME}' ensured in namespace '{METRIC_NAMESPACE}'.")

def main():
    session = boto3.Session(region_name=REGION)
    logs_client = session.client("logs")
    cw_client = session.client("cloudwatch")

    # Optional: validate log group exists
    try:
        logs_client.describe_log_groups(
            logGroupNamePrefix=LOG_GROUP_NAME,
            limit=1
        )
    except botocore.exceptions.ClientError as e:
        raise SystemExit(f"Error validating log group: {e}")

    ensure_metric_filter(logs_client)
    ensure_alarm(cw_client)

if __name__ == "__main__":
    main()

4. Run the script​

pip install boto3
python ensure_aws_config_changes_alarm.py

5. Verify​

  • In CloudWatch Console:
    • Logs → Log groups → select your CloudTrail log group → Metric filters: confirm AWSConfigChangesFilter.
    • Alarms → All alarms: confirm AWSConfigChangesAlarm is present, in OK state.
  • Trigger a test (e.g. modify Config recorder) and confirm:
    • Metric increments.
    • Alarm enters ALARM state.
    • SNS notification is received.

If you share your exact log group name and SNS topic ARN, I can tailor the script precisely to your environment.

Using Terraform
# CloudWatch Logs Metric Filter for AWS Config configuration changes
resource "aws_cloudwatch_log_metric_filter" "config_changes" {
  name           = "ConfigChangesFilter"
  log_group_name = "CLOUDTRAIL_LOG_GROUP_NAME" # replace with your CloudTrail log group name

  pattern = "{ ($.eventName = StopConfigurationRecorder) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = PutDeliveryChannel) || ($.eventName = PutConfigurationRecorder) }"

  metric_transformation {
    name      = "ConfigChangesMetric"
    namespace = "CloudTrailMetrics"
    value     = "1"
  }
}

# SNS Topic for alarm notifications
resource "aws_sns_topic" "config_changes_alarm_topic" {
  name = "ConfigChangesAlarmTopic"
}

# SNS email subscription (must be confirmed via email before it becomes active)
resource "aws_sns_topic_subscription" "config_changes_email" {
  topic_arn = aws_sns_topic.config_changes_alarm_topic.arn
  protocol  = "email"
  endpoint  = "YOUR_EMAIL@example.com" # replace with a valid email address
}

# CloudWatch Alarm for AWS Config configuration changes
resource "aws_cloudwatch_metric_alarm" "config_changes_alarm" {
  alarm_name          = "ConfigChangesAlarm"
  alarm_description   = "Alarm for AWS Config service configuration changes"
  namespace           = "CloudTrailMetrics"
  metric_name         = "ConfigChangesMetric"
  statistic           = "Sum"
  period              = 300
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"

  alarm_actions = [
    aws_sns_topic.config_changes_alarm_topic.arn,
  ]

  depends_on = [
    aws_cloudwatch_log_metric_filter.config_changes,
  ]
}

This remediation creates new resources (metric filter, SNS topic + subscription, and CloudWatch alarm); ensure you don’t have conflicting resources with the same names before applying. The email subscription requires manual confirmation from the inbox for YOUR_EMAIL@example.com before alerts will be delivered.

For verification, terraform plan should show these resources as + create (and no unexpected changes to existing CloudWatch alarms, SNS topics, or log groups).

Additional Reading:​