> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# IAM Policy Changes Alarm

### More Info:

AWS IAM policy configuration changes should be monitored using CloudWatch alarms.

### Risk Level

High

### Address

Security

### Compliance Standards

SOC2, HIPAA, ISO27001, AWSWAF, HITRUST, CISAWS, CBP, NISTCSF, PCIDSS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. **Configure CloudTrail to Deliver Logs to CloudWatch Logs**:
           * Go to the AWS Management Console.
           * Open the CloudTrail service.
           * Select your trail.
           * Click on "Edit".
           * In the "CloudWatch Logs" section, select an existing log group or create a new one.
           * Click "Save changes".

        2. **Create Metric Filter and Alarm**:
           * Go to the CloudWatch service in the AWS Management Console.
           * In the left-hand navigation pane, choose "Logs" and then select the log group you configured in CloudTrail.
           * Click on "Create metric filter".
           * Define a filter pattern that matches IAM policy changes. For example, you might use a pattern like `{ $.eventSource = "iam.amazonaws.com" && $.eventName = "AttachRolePolicy" }`.
           * Click "Assign metric".
           * Give your metric a name like `IAMPolicyChangesEventCount` or `IAMPolicyEventCount`.
           * Click "Create filter".
           * Once your filter is created, you can set up an alarm based on this metric.

        #
      </Accordion>

      <Accordion title="Using CLI">
        1. **Create Metric Filter**:

           ```bash theme={null}
           aws logs put-metric-filter \
             --log-group-name "YOUR_LOG_GROUP_NAME" \
             --filter-name "IAMPolicyChangesFilter" \
             --filter-pattern '{ $.eventSource = "iam.amazonaws.com" && $.eventName = "AttachRolePolicy" }' \
             --metric-transformations "metricName=IAMPolicyChangesEventCount,metricNamespace=CloudTrailMetrics,metricValue=1"
           ```

           or

           ```bash theme={null}
           aws logs put-metric-filter \
             --log-group-name "YOUR_LOG_GROUP_NAME" \
             --filter-name "IAMPolicyChangesFilter" \
             --filter-pattern '{ $.eventSource = "iam.amazonaws.com" && $.eventName = "AttachRolePolicy" }' \
             --metric-transformations "metricName=IAMPolicyEventCount,metricNamespace=CloudTrailMetrics,metricValue=1"
           ```

           Replace `"YOUR_LOG_GROUP_NAME"` with the name of your CloudTrail log group.

        2. **Create CloudWatch Alarm** (optional):
           Use the `put-metric-alarm` command to create an alarm based on the metric you created.
      </Accordion>

      <Accordion title="Using Python">
        Set an alarm for "IAMPolicyChangesEventCount" Metric

        ```python theme={null}
        import boto3

        cloudwatch_logs = boto3.client('logs')
        cloudwatch = boto3.client('cloudwatch')

        # Create Metric Filter
        response = cloudwatch_logs.put_metric_filter(
            logGroupName='YOUR_LOG_GROUP_NAME',
            filterName='IAMPolicyChangesFilter',
            filterPattern='{ $.eventSource = "iam.amazonaws.com" && $.eventName = "AttachRolePolicy" }',
            metricTransformations=[
                {
                    'metricName': 'IAMPolicyChangesEventCount',
                    'metricNamespace': 'CloudTrailMetrics',
                    'metricValue': 1
                }
            ]
        )

        # Create CloudWatch Alarm (optional)
        # You can use cloudwatch.put_metric_alarm() to create an alarm based on the metric
        ```

        Or set an alarm for "IAMPolicyEventCount" Metric

        ```python theme={null}
        import boto3

        cloudwatch_logs = boto3.client('logs')
        cloudwatch = boto3.client('cloudwatch')

        # Create Metric Filter
        response = cloudwatch_logs.put_metric_filter(
            logGroupName='YOUR_LOG_GROUP_NAME',
            filterName='IAMPolicyChangesFilter',
            filterPattern='{ $.eventSource = "iam.amazonaws.com" && $.eventName = "AttachRolePolicy" }',
            metricTransformations=[
                {
                    'metricName': 'IAMPolicyEventCount',
                    'metricNamespace': 'CloudTrailMetrics',
                    'metricValue': 1
                }
            ]
        )


        # Create CloudWatch Alarm (optional)
        # You can use cloudwatch.put_metric_alarm() to create an alarm based on the metric
        ```

        Replace `"YOUR_LOG_GROUP_NAME"` with the name of your CloudTrail log group.

        These steps should help you set up the `IAMPolicyChangesEventCount` or `IAMPolicyEventCount` metric in CloudWatch using the AWS Console, AWS CLI, or Python script. Remember to adjust the configuration according to your specific use case and environment.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://aws.amazon.com/blogs/security/how-to-receive-alerts-when-your-iam-configuration-changes/](https://aws.amazon.com/blogs/security/how-to-receive-alerts-when-your-iam-configuration-changes/)