CloudTrail Changes Alarm
More Info:
All AWS CloudTrail configuration changes should be monitored using CloudWatch alarms.Risk Level
MediumAddress
SecurityCompliance Standards
CISAWSF, PCI, GDPR, APRA, MAS, NIST4, SOC2, HIPAA, ISO27001, NISTCSFTriage and Remediation
Remediation
Using Console
Using Console
Here are the step-by-step instructions to remediate the CloudTrail Changes Alarm misconfiguration in AWS using the AWS console:
- Sign in to your AWS account and navigate to the CloudWatch service.
- In the left-hand menu, select “Logs”.
- Select the log group created for your CloudTrail trail event logs and click on the “Create Metric Filter” button.
- On the Define Logs Metric Filter page, in the Filter Pattern box, enter the following pattern:
{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging) }This pattern monitors CloudTrail for changes like creating, updating, or deleting trails.- Review the metric filter details and click Assign Metric.
-
On the next page, provide the following details:
- Filter Name: Enter a name like
AWSCloudTrailChanges. - Metric Namespace: Enter
CloudTrailMetrics. - Metric Name: Enter
CloudTrailEventCount. - Click Show advanced metric settings, and in the Metric Value box, enter
1.
- Filter Name: Enter a name like
- Review the details and click Create Filter.
- Now, click Create Alarm for the filter created in the previous step.
-
In the Create Alarm dialog, configure the following:
- Alarm Name: Enter
CloudTrail Changes. - Threshold: Set the threshold value to
1(greater than or equal to 1). - Actions: Click the + Notification button, select State is ALARM, and choose an SNS topic for notifications.
- Period: Select
5 Minutesfrom the dropdown. - Statistic: Set to
Sum.
- Alarm Name: Enter
- Review the configuration and click Create Alarm to finalize.
Using CLI
Using CLI
The CloudTrail Changes Alarm monitors changes in CloudTrail configuration. Here are the steps to set up the alarm using AWS CLI:These commands set up the CloudWatch alarm to monitor CloudTrail configuration changes using AWS CLI.
- Run the following command to create a CloudWatch metric filter and associate it with the CloudTrail log group:
- Use the following command to create a CloudWatch alarm triggered by changes to CloudTrail:
Using Python
Using Python
To remediate the CloudTrail Changes Alarm misconfiguration using Python, we can use the AWS SDK for Python (boto3) to automate both the CloudTrail and CloudWatch configurations. Here’s a sample code:This script enables CloudWatch logs for your CloudTrail and sets up a CloudWatch alarm for tracking changes to your CloudTrail configurations.