> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Internet Gateway Changes Alarm ### More Info: AWS VPC Customer/Internet Gateway configuration changes should be monitored using CloudWatch alarms. ### Risk Level Medium ### Address Security ### Compliance Standards SOC2, HIPAA, ISO27001, NIST4, CISAWSF, PCI, APRA, MAS ### Triage and Remediation ### Remediation To remediate the "Internet Gateway Changes Alarm" misconfiguration in AWS using the AWS console, follow these steps: 1. Sign in to the AWS Management Console. 2. Navigate to the CloudWatch dashboard at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). 3. In the left navigation panel, select **Logs**. 4. Select the log group created for your CloudTrail trail event logs and click **Create Metric Filter**. 5. On the **Define Logs Metric Filter** page, paste the following pattern inside the **Filter Pattern** box: ``` { ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) } ``` This pattern will be used for scanning the AWS CloudTrail logs for event names like `“CreateInternetGateway”`, `“AttachInternetGateway”` or `“DeleteInternetGateway”`. 6. Review the metric filter configuration details, then click **Assign Metric**. 7. On the **Create Metric Filter and Assign a Metric** page, perform the following: * In the **Filter Name** box, enter a unique name for the new filter, e.g., `VPCGatewayConfigChanges`. * In the **Metric Namespace** box, type `CloudTrailMetrics`. * In the **Metric Name** box, type `GatewayEventCount` for the metric identifier. * Click **Show advanced metric settings** to slide down the advanced settings section. * In the **Metric Value** box, enter `1`. 8. Review the details, then click **Create Filter** to generate your new CloudWatch Logs metric filter. 9. On the current page, click **Create Alarm**. 10. In the **Create Alarm** dialog box, provide the following information: - Within the **Alarm Threshold** section, in the **Name** and **Description** fields, enter a unique name and a short description for the new CloudWatch alarm. - Under **Whenever: Metric Name**, select `>= (greater than or equal to)` from the dropdown list and enter `1` as the threshold value to trigger the alarm every time a configuration change involving a VPC Network Customer/Internet Gateway is made. - In the **Actions** section, click the **+ Notification** button, select `State is ALARM` from the **Whenever this alarm** dropdown menu, and choose the AWS SNS topic name created at Step 1 from **Send notification to**. - In the **Alarm Preview** section, select `5 Minutes` from the **Period** dropdown list and `Sum` from the **Statistic** list. - Review the CloudWatch alarm configuration details, then click **Create Alarm**. Once created, the new alarm will be listed on the Alarms page. To remediate the "Internet Gateway Changes Alarm" misconfiguration using the AWS CLI, follow these steps: 1. Open the AWS CLI on your local machine. 2. Run the following command to create the necessary CloudWatch metric filter and associate it with your Amazon CloudTrail log group (the command does not return an output): ```bash theme={null} aws logs put-metric-filter \ --region us-east-1 \ --log-group-name CloudTrail/CloudWatchLogGroup \ --filter-name VPCGatewayConfigChanges \ --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }' \ --metric-transformations metricName=GatewayEventCount,metricNamespace=CloudTrailMetrics,metricValue=1 ``` 3. Run the following command to create the AWS CloudWatch alarm that will fire whenever a configuration change involving an AWS VPC Customer/Internet Gateway will be made (the command does not return an output): ```bash theme={null} aws cloudwatch put-metric-alarm \ --region us-east-1 \ --alarm-name VPCGatewayConfigChangesAlarm \ --alarm-description "Triggered by VPC Customer/Internet Gateway changes." \ --metric-name GatewayEventCount \ --namespace CloudTrailMetrics \ --statistic Sum \ --comparison-operator GreaterThanOrEqualToThreshold \ --evaluation-periods 1 \ --period 300 \ --threshold 1 \ --actions-enabled \ --alarm-actions arn:aws:sns:us-east-1:123456789 ``` The misconfiguration "Internet Gateway Changes Alarm" in AWS can occur when there is a change in the Internet Gateway associated with the VPC. To remediate this, you can follow these steps using Python: 1. Import the necessary modules and define the AWS client: ```python theme={null} import boto3 client = boto3.client('logs') cloudwatch = boto3.client('cloudwatch') ``` 2. Define the log group name, metric filter name, and alarm name: ``` log_group_name = 'CloudTrail/CloudWatchLogGroup' filter_name = 'VPCGatewayConfigChanges' alarm_name = 'VPCGatewayConfigChangesAlarm' ``` 3. Create the metric filter using the `put_metric_filter` method: ```python theme={null} response = client.put_metric_filter( logGroupName=log_group_name, filterName=filter_name, filterPattern='{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }', metricTransformations=[ { 'metricName': 'GatewayEventCount', 'metricNamespace': 'CloudTrailMetrics', 'metricValue': '1' } ] ) ``` 4. Create the CloudWatch alarm using the put\_metric\_alarm method: ``` cloudwatch.put_metric_alarm( AlarmName=alarm_name, AlarmDescription="Triggered by VPC Customer/Internet Gateway changes.", MetricName='GatewayEventCount', Namespace='CloudTrailMetrics', Statistic='Sum', Period=300, EvaluationPeriods=1, Threshold=1, ComparisonOperator='GreaterThanOrEqualToThreshold', ActionsEnabled=True, AlarmActions=['arn:aws:sns:us-east-1:123456789012:CloudWatchAlarmSNSTopic'] ) ``` 5. Verify the alarm has been created: ``` response = cloudwatch.describe_alarms( AlarmNames=[alarm_name] ) if len(response['MetricAlarms']) > 0: print(f"The alarm '{alarm_name}' has been created successfully.") else: print(f"Failed to create the alarm '{alarm_name}'.") ``` ### Additional Reading: * [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) * [https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch\_concepts.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html) * [https://docs.aws.amazon.com/vpc/latest/userguide/VPC\_Internet\_Gateway.html](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html)