Network ACL Changes Alarm
More Info:
AWS Network ACLs configuration changes should be monitored using CloudWatch alarms.Risk Level
MediumAddress
SecurityCompliance Standards
SOC2, AWSWAF, HITRUST, CISAWS, CBP, NISTCSF, CISAWSF, PCI, APRA, MAS, NIST4Triage and Remediation
Remediation
Using Console
Using Console
The “Network ACL Changes Alarm” indicates that changes have been made to the Network Access Control List (NACL) in your AWS account. To set up this alarm and monitor NACL changes, follow these steps:This filter will capture relevant NACL creation, update, and deletion events.
- Open the AWS Management Console and navigate to CloudWatch.
- In the left navigation panel, select Logs.
- Select the log group created for your CloudTrail trail event logs, and click Create Metric Filter.
- On the Define Logs Metric Filter page, enter the following pattern in the Filter Pattern box:
- Review the metric filter details and click Assign Metric.
-
On the Create Metric Filter and Assign a Metric page:
- In the Filter Name box, enter
NetworkACLConfigChanges. - In the Metric Namespace box, enter
CloudTrailMetrics. - In the Metric Name box, enter
NetworkAclEventCount. - Click Show advanced metric settings to expand the settings, and in the Metric Value box, enter
1.
- In the Filter Name box, enter
- Review the details and click Create Filter to finalize the metric filter.
- After creating the filter, click Create Alarm.
-
In the Create Alarm dialog box:
- In the Name field, enter a unique name, such as
NetworkACLConfigChangesAlarm. - Set the alarm to trigger when the metric value is >= 1.
- Under Actions, click + Notification, and choose State is ALARM. Select the SNS topic to notify when the alarm triggers.
- In the Name field, enter a unique name, such as
- In the Alarm Preview section, set the evaluation period to 5 Minutes, and the statistic type to Sum.
- Review the alarm configuration and click Create Alarm.
Using CLI
Using CLI
To set up the Network ACL Changes Alarm using the AWS CLI, follow these steps:Replace Replace
- Run the following command to create a CloudWatch metric filter that monitors CloudTrail logs for Network ACL changes:
region with your AWS region.- Create a CloudWatch alarm that will trigger whenever there is a change to a Network ACL:
region with your AWS region and account_id with your AWS account ID.By following these CLI steps, you can automate the creation of the necessary CloudWatch metric filters and alarms to monitor changes to your Network ACLs.Using Python
Using Python
The Network ACL Changes Alarm is triggered when changes are made to Network Access Control Lists (NACLs) in your AWS environment. To implement the remediation using Python, follow these steps:This code sets up a CloudWatch metric filter to monitor for NACL changes (such as CreateNetworkAcl, DeleteNetworkAcl, etc.) by scanning CloudTrail logs. Creates a CloudWatch alarm that triggers when the metric detects a Network ACL change, sending a notification to the specified SNS topic.
- Identify the source of change: Use the AWS CloudTrail service to track the source of any changes. CloudTrail logs all API calls made in your AWS account, which will help you identify who made the change and when it occurred.
- Review the change: Once the source is identified, review the change to ensure it aligns with your organization’s security policies and best practices.
- Roll back the change: If the change was made in error or violates your security policies, use the AWS CLI or AWS Management Console to roll back the change.
- Update NACLs: If the change is legitimate, ensure that your NACLs are updated accordingly using the AWS CLI or AWS Management Console.
- Monitor future changes: Set up monitoring to track future NACL changes and use alerts to notify you of unauthorized modifications.