> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Aws config changes alarm remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below is how to set up an AWS Config changes alarm in CloudWatch **using only the AWS Management Console**. This follows the common CIS-style pattern: CloudTrail → CloudWatch Logs → Metric Filter → Alarm.

        ***

        ## Prerequisites (quick checks)

        1. **CloudTrail is enabled** and recording management events.
        2. **CloudTrail is delivering logs to a CloudWatch Logs log group.**

        If you already have a CloudTrail trail that sends logs to a CloudWatch Logs log group, skip to **Step 2**.

        ***

        ## Step 1 – (If needed) Send CloudTrail logs to CloudWatch Logs

        1. In the AWS console, go to **CloudTrail**.
        2. Click **Trails** in the left menu.
        3. Select your main trail (or create one if you don’t have it).
        4. In the **CloudWatch Logs** section:
           * Click **Edit** (or **Configure**).
           * Choose an existing log group or create a new one (e.g., `/aws/cloudtrail/main`).
           * Choose/create an IAM role as prompted.
           * Save the configuration.

        Note the **CloudWatch Logs log group name**; you’ll need it in the next step.

        ***

        ## Step 2 – Create a metric filter for AWS Config changes

        1. Go to **CloudWatch** in the AWS console.

        2. In the left menu, under **Logs**, click **Log groups**.

        3. Click the CloudTrail log group (e.g., `/aws/cloudtrail/main`).

        4. Go to the **Metric filters** tab.

        5. Click **Create metric filter**.

        6. In **Filter pattern**, paste this filter to catch AWS Config configuration changes:

           ```text theme={null}
           { ($.eventSource = "config.amazonaws.com") && 
             (
               $.eventName = "StopConfigurationRecorder" ||
               $.eventName = "DeleteDeliveryChannel"      ||
               $.eventName = "PutConfigurationRecorder"   ||
               $.eventName = "PutDeliveryChannel"         ||
               $.eventName = "PutConfigurationAggregator" ||
               $.eventName = "DeleteConfigurationAggregator" ||
               $.eventName = "PutOrganizationConfigRule"  ||
               $.eventName = "DeleteOrganizationConfigRule" ||
               $.eventName = "PutConfigRule"              ||
               $.eventName = "DeleteConfigRule"
             )
           }
           ```

           (You can add/remove event names depending on what you want to monitor.)

        7. Click **Next** to test the pattern (optional but recommended), then **Next**.

        8. Under **Assign metric**:
           * Metric name: `AWSConfigChanges`
           * Metric namespace: `SecurityMonitoring` (or any name you prefer)
           * Metric value: `1`

        9. Click **Next**, then **Create metric filter**.

        ***

        ## Step 3 – Create a CloudWatch alarm on the metric

        1. Still in **CloudWatch**, in the left menu click **Alarms → All alarms**.

        2. Click **Create alarm**.

        3. Click **Select metric**.

        4. Navigate to the namespace you used above (e.g., **SecurityMonitoring**).

        5. Select the metric **AWSConfigChanges**, then click **Select metric**.

        6. Configure the alarm:
           * **Statistic**: `Sum`
           * **Period**: e.g., `5 minutes`
           * **Threshold type**: `Static`
           * Condition: **Greater/Equal** `1`
           * Meaning: if at least one AWS Config change event occurs in 5 minutes, the alarm triggers.

        7. Click **Next**.

        8. **Notification**:
           * Under **Alarm state trigger**, ensure **In alarm** is selected.
           * Choose an existing SNS topic (for email/Slack/etc.) or **Create new topic**:
             * Enter topic name (e.g., `aws-config-changes-alerts`).
             * Enter your email address (or other endpoint).
             * After creation, confirm the subscription via the email you receive.

        9. Click **Next**.

        10. **Name and description**:
            * Name: `AWSConfigChangesAlarm`
            * Description: `Alarm on AWS Config configuration changes via CloudTrail`

        11. Click **Next**, review, then **Create alarm**.

        ***

        ## Step 4 – (Optional) Test the alarm

        1. Make a benign AWS Config change (e.g., adjust a Config rule or delivery channel in a test account).
        2. Wait for the CloudWatch period (e.g., 5–10 minutes).
        3. Confirm:
           * The CloudWatch alarm transitions to **ALARM**.
           * The SNS notification is received (email, etc.).

        Once these steps are complete, you have an **AWS Config changes alarm enabled in CloudWatch** via the AWS console.
      </Accordion>

      <Accordion title="Using CLI">
        Below are end‑to‑end AWS CLI steps to create a CloudWatch alarm for AWS Config changes (using CloudTrail → CloudWatch Logs → metric filter → alarm).

        Assumptions:

        * You already have a CloudTrail trail sending events to a CloudWatch Logs log group (e.g., `/aws/cloudtrail/logs`).
        * You have AWS CLI configured with appropriate permissions.

        ***

        ### 1. Identify the CloudTrail log group

        If you don’t know the log group, list CloudWatch log groups:

        ```bash theme={null}
        aws logs describe-log-groups
        ```

        Assume the log group name is:

        ```bash theme={null}
        LOG_GROUP_NAME="/aws/cloudtrail/logs"
        ```

        ***

        ### 2. Create a metric filter for AWS Config changes

        Filter on AWS Config API calls that change the configuration recorder or delivery channel:

        ```bash theme={null}
        aws logs put-metric-filter \
          --log-group-name "$LOG_GROUP_NAME" \
          --filter-name "AWSConfigChangesFilter" \
          --filter-pattern '{ ($.eventSource = "config.amazonaws.com") && ( ($.eventName = "StopConfigurationRecorder") || ($.eventName = "DeleteDeliveryChannel") || ($.eventName = "PutConfigurationRecorder") || ($.eventName = "PutDeliveryChannel") ) }' \
          --metric-transformations \
            metricName="AWSConfigChanges",metricNamespace="Security",metricValue="1"
        ```

        This will publish a metric `Security/AWSConfigChanges` with value `1` each time one of those events appears.

        ***

        ### 3. Create a CloudWatch alarm on the metric

        Create an alarm that triggers if at least 1 such event occurs in a 5‑minute window:

        ```bash theme={null}
        aws cloudwatch put-metric-alarm \
          --alarm-name "AWSConfigChangesAlarm" \
          --alarm-description "Alarm when AWS Config configuration recorder or delivery channel is modified" \
          --metric-name "AWSConfigChanges" \
          --namespace "Security" \
          --statistic "Sum" \
          --period 300 \
          --evaluation-periods 1 \
          --threshold 1 \
          --comparison-operator "GreaterThanOrEqualToThreshold" \
          --treat-missing-data "notBreaching" \
          --alarm-actions "arn:aws:sns:REGION:ACCOUNT_ID:SECURITY-TOPIC"
        ```

        Replace:

        * `REGION` with your region (e.g., `us-east-1`)
        * `ACCOUNT_ID` with your AWS account ID
        * `SECURITY-TOPIC` with an existing SNS topic ARN for notifications.

        If you don’t have an SNS topic:

        ```bash theme={null}
        aws sns create-topic --name Security-Alerts
        ```

        Then use the returned `TopicArn` in `--alarm-actions` and subscribe your email:

        ```bash theme={null}
        aws sns subscribe \
          --topic-arn "arn:aws:sns:REGION:ACCOUNT_ID:Security-Alerts" \
          --protocol email \
          --notification-endpoint "you@example.com"
        ```

        ***

        Once done, any AWS Config configuration recorder or delivery channel change will generate a CloudTrail event, be picked up by the metric filter, and trigger the CloudWatch alarm, satisfying “AWS Config Changes Alarm Should Be Enabled.”
      </Accordion>

      <Accordion title="Using Python">
        Below is a step‑by‑step approach and example Python (boto3) code to ensure an **“AWS Config Changes” alarm** exists in CloudWatch. This follows the typical CIS-style requirement: a CloudWatch Logs metric filter on CloudTrail logs for AWS Config changes, plus a CloudWatch alarm on that metric.

        ***

        ## 1. Prerequisites

        * You have:
          * A CloudTrail trail delivering logs to a CloudWatch Logs log group (e.g. `/aws/cloudtrail/logs`).
          * An SNS topic ARN for alarm notifications (e.g. `arn:aws:sns:us-east-1:111122223333:SecurityNotifications`).
        * Python 3 and `boto3` installed.
        * AWS credentials configured (env vars, profile, or instance role).

        ***

        ## 2. Define the metric filter pattern

        CIS-like pattern for AWS Config configuration recorder changes:

        ```text theme={null}
        { ($.eventSource = "config.amazonaws.com") && 
          (($.eventName = "StopConfigurationRecorder") || 
           ($.eventName = "DeleteDeliveryChannel") || 
           ($.eventName = "PutDeliveryChannel") || 
           ($.eventName = "PutConfigurationRecorder")) }
        ```

        You’ll use this in the CloudWatch Logs metric filter.

        ***

        ## 3. Python script to create/update metric filter and alarm

        Adjust the variables at the top as needed (region, account ID, log group, SNS topic, metric/alarm names).

        ```python theme={null}
        import boto3
        import botocore

        REGION = "us-east-1"
        ACCOUNT_ID = "111122223333"
        LOG_GROUP_NAME = "/aws/cloudtrail/logs"  # Your CloudTrail log group
        METRIC_NAMESPACE = "CIS/CloudTrailMetrics"
        METRIC_NAME = "AWSConfigChanges"
        FILTER_NAME = "AWSConfigChangesFilter"
        ALARM_NAME = "AWSConfigChangesAlarm"
        SNS_TOPIC_ARN = "arn:aws:sns:us-east-1:111122223333:SecurityNotifications"

        FILTER_PATTERN = (
            '{ ($.eventSource = "config.amazonaws.com") && '
            '( ($.eventName = "StopConfigurationRecorder") || '
            '  ($.eventName = "DeleteDeliveryChannel") || '
            '  ($.eventName = "PutDeliveryChannel") || '
            '  ($.eventName = "PutConfigurationRecorder") ) }'
        )

        def ensure_metric_filter(logs_client):
            # Create or update metric filter on the CloudTrail log group
            logs_client.put_metric_filter(
                logGroupName=LOG_GROUP_NAME,
                filterName=FILTER_NAME,
                filterPattern=FILTER_PATTERN,
                metricTransformations=[
                    {
                        "metricName": METRIC_NAME,
                        "metricNamespace": METRIC_NAMESPACE,
                        "metricValue": "1"
                    }
                ]
            )
            print(f"Metric filter '{FILTER_NAME}' ensured on log group '{LOG_GROUP_NAME}'.")

        def ensure_alarm(cw_client):
            # Create or update CloudWatch alarm tied to the metric
            cw_client.put_metric_alarm(
                AlarmName=ALARM_NAME,
                AlarmDescription="Alarm when AWS Config recorder or delivery channel is changed",
                Namespace=METRIC_NAMESPACE,
                MetricName=METRIC_NAME,
                Statistic="Sum",
                Period=300,               # 5 minutes
                EvaluationPeriods=1,
                Threshold=1,
                ComparisonOperator="GreaterThanOrEqualToThreshold",
                TreatMissingData="notBreaching",
                ActionsEnabled=True,
                AlarmActions=[SNS_TOPIC_ARN],
                OKActions=[SNS_TOPIC_ARN],
                Dimensions=[
                    {
                        "Name": "AccountId",
                        "Value": ACCOUNT_ID
                    }
                ]
            )
            print(f"Alarm '{ALARM_NAME}' ensured in namespace '{METRIC_NAMESPACE}'.")

        def main():
            session = boto3.Session(region_name=REGION)
            logs_client = session.client("logs")
            cw_client = session.client("cloudwatch")

            # Optional: validate log group exists
            try:
                logs_client.describe_log_groups(
                    logGroupNamePrefix=LOG_GROUP_NAME,
                    limit=1
                )
            except botocore.exceptions.ClientError as e:
                raise SystemExit(f"Error validating log group: {e}")

            ensure_metric_filter(logs_client)
            ensure_alarm(cw_client)

        if __name__ == "__main__":
            main()
        ```

        ***

        ## 4. Run the script

        ```bash theme={null}
        pip install boto3
        python ensure_aws_config_changes_alarm.py
        ```

        ***

        ## 5. Verify

        * In CloudWatch Console:
          * Logs → Log groups → select your CloudTrail log group → Metric filters: confirm `AWSConfigChangesFilter`.
          * Alarms → All alarms: confirm `AWSConfigChangesAlarm` is present, in OK state.
        * Trigger a test (e.g. modify Config recorder) and confirm:
          * Metric increments.
          * Alarm enters ALARM state.
          * SNS notification is received.

        If you share your exact log group name and SNS topic ARN, I can tailor the script precisely to your environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # CloudWatch Logs Metric Filter for AWS Config configuration changes
        resource "aws_cloudwatch_log_metric_filter" "config_changes" {
          name           = "ConfigChangesFilter"
          log_group_name = "CLOUDTRAIL_LOG_GROUP_NAME" # replace with your CloudTrail log group name

          pattern = "{ ($.eventName = StopConfigurationRecorder) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = PutDeliveryChannel) || ($.eventName = PutConfigurationRecorder) }"

          metric_transformation {
            name      = "ConfigChangesMetric"
            namespace = "CloudTrailMetrics"
            value     = "1"
          }
        }

        # SNS Topic for alarm notifications
        resource "aws_sns_topic" "config_changes_alarm_topic" {
          name = "ConfigChangesAlarmTopic"
        }

        # SNS email subscription (must be confirmed via email before it becomes active)
        resource "aws_sns_topic_subscription" "config_changes_email" {
          topic_arn = aws_sns_topic.config_changes_alarm_topic.arn
          protocol  = "email"
          endpoint  = "YOUR_EMAIL@example.com" # replace with a valid email address
        }

        # CloudWatch Alarm for AWS Config configuration changes
        resource "aws_cloudwatch_metric_alarm" "config_changes_alarm" {
          alarm_name          = "ConfigChangesAlarm"
          alarm_description   = "Alarm for AWS Config service configuration changes"
          namespace           = "CloudTrailMetrics"
          metric_name         = "ConfigChangesMetric"
          statistic           = "Sum"
          period              = 300
          evaluation_periods  = 1
          threshold           = 1
          comparison_operator = "GreaterThanOrEqualToThreshold"

          alarm_actions = [
            aws_sns_topic.config_changes_alarm_topic.arn,
          ]

          depends_on = [
            aws_cloudwatch_log_metric_filter.config_changes,
          ]
        }
        ```

        This remediation creates new resources (metric filter, SNS topic + subscription, and CloudWatch alarm); ensure you don’t have conflicting resources with the same names before applying. The email subscription requires manual confirmation from the inbox for `YOUR_EMAIL@example.com` before alerts will be delivered.

        For verification, `terraform plan` should show these resources as `+ create` (and no unexpected changes to existing CloudWatch alarms, SNS topics, or log groups).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>