> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Network acl changes alarm remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step instructions using only the AWS Management Console, assuming you already have a CloudTrail trail logging management events in all regions to a CloudWatch Logs log group. If not, I’ll include the prerequisite steps first.

        ***

        ## 0. Prerequisite: Ensure CloudTrail is Logging to CloudWatch Logs

        1. Open **CloudTrail** console.
        2. Go to **Trails** in the left menu.
        3. Select your main trail (or create one if you don’t have it).
        4. In the trail details page, under **CloudWatch Logs**, choose **Edit** (or **Configure**).
        5. For **CloudWatch Logs log group**, either:
           * Choose an existing log group, or
           * Type a new log group name (e.g., `/aws/cloudtrail/management`).
        6. Select or create an IAM role as prompted to allow CloudTrail to write to CloudWatch Logs.
        7. Save changes and confirm events are being delivered (check the log group after a few minutes).

        ***

        ## 1. Create a Metric Filter for Network ACL Changes

        1. Open **CloudWatch** console.

        2. In the left navigation pane, select **Logs → Log groups**.

        3. Click the log group where CloudTrail is sending logs (e.g., `/aws/cloudtrail/management`).

        4. Select the **Metric filters** tab.

        5. Click **Create metric filter**.

        6. In **Filter pattern**, paste:

           ```text theme={null}
           { ($.eventSource = "ec2.amazonaws.com") &&
             (($.eventName = "CreateNetworkAcl") ||
              ($.eventName = "CreateNetworkAclEntry") ||
              ($.eventName = "DeleteNetworkAcl") ||
              ($.eventName = "DeleteNetworkAclEntry") ||
              ($.eventName = "ReplaceNetworkAclEntry") ||
              ($.eventName = "ReplaceNetworkAclAssociation")) }
           ```

        7. Click **Next** to test; choose a log event sample if available and verify it would match where appropriate.

        8. Click **Next**.

        9. Under **Assign metric**, configure:
           * **Filter name**: `NetworkACLChanges`
           * **Metric namespace**: `Security/CloudTrail` (or similar)
           * **Metric name**: `NetworkACLChangesCount`
           * **Metric value**: `1`
           * Leave default for others unless you have a standard.

        10. Click **Next**, then **Create metric filter**.

        ***

        ## 2. Create a CloudWatch Alarm on That Metric

        1. In **CloudWatch**, go to **Alarms → All alarms**.

        2. Click **Create alarm**.

        3. Click **Select metric**.

        4. Navigate to your metric via:
           * **Browse** → **Security/CloudTrail** (or your namespace) → **Metrics with no dimensions** (or the one you chose), then select `NetworkACLChangesCount`.

        5. Click **Select metric**.

        6. Configure the metric and conditions:

           * **Statistic**: `Sum`
           * **Period**: e.g., `5 minutes` (or `1 minute` if you want very fast alerts).
           * **Threshold type**: `Static`
           * **Whenever NetworkACLChangesCount is…** `Greater than or equal to`
           * **Threshold value**: `1`.

           This means any NACL change in that period will fire the alarm.

        7. Click **Next**.

        8. Configure notification:
           * Under **Notification**, choose **In alarm**.
           * For **Select an SNS topic**:
             * Choose an existing topic (e.g., `security-alerts`), **or**
             * Click **Create new topic**, give it a name, and enter your email address (or distribution list).
           * Confirm subscription from the email if you created a new topic.

        9. Click **Next**.

        10. Name and description:
            * **Alarm name**: `NetworkACLChangesAlarm`
            * **Alarm description**: `Alarm when any Network ACL is created, deleted, or modified`.

        11. Review the configuration, then click **Create alarm**.

        ***

        ## 3. Validate

        1. Make a test NACL change (e.g., add a temporary rule in a test VPC).
        2. Wait for CloudTrail to deliver the log and CloudWatch to evaluate the metric (1–5 minutes, depending on your period).
        3. Confirm:
           * The metric `NetworkACLChangesCount` shows a data point > 0.
           * The alarm enters **ALARM** state.
           * A notification is sent to your SNS subscribers.

        Once this is in place, “Network ACL Changes Alarm” is effectively enabled and will notify you of any NACL modifications recorded by CloudTrail.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the CLI-focused remediation steps to ensure you have a CloudWatch alarm on Network ACL changes (via CloudTrail logs).

        Assumptions (adjust names/regions as needed):

        * Region: `us-east-1`
        * Log group: `/aws/cloudtrail/netacl-logs`
        * Metric name: `NetworkAclChanges`
        * Metric namespace: `SecurityMonitoring`
        * Alarm name: `NetworkAclChangesAlarm`
        * SNS topic (for notifications): `arn:aws:sns:us-east-1:123456789012:SecurityAlerts`

        ***

        ## 1. Ensure CloudTrail is logging to CloudWatch Logs

        If you already have a CloudTrail configured to send logs to CloudWatch Logs, skip to step 2.

        ### 1.1 Create a log group (if needed)

        ```bash theme={null}
        aws logs create-log-group \
          --log-group-name "/aws/cloudtrail/netacl-logs" \
          --region us-east-1
        ```

        ### 1.2 Allow CloudTrail to write to the log group (IAM role/policy)

        Create an IAM role for CloudTrail (if you don’t have one). Example trust policy file `trust-policy.json`:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Principal": { "Service": "cloudtrail.amazonaws.com" },
            "Action": "sts:AssumeRole"
          }]
        }
        ```

        ```bash theme={null}
        aws iam create-role \
          --role-name CloudTrail_CloudWatchLogs_Role \
          --assume-role-policy-document file://trust-policy.json
        ```

        Attach permissions policy file `cloudtrail-cwlogs-policy.json`:

        ```json theme={null}
        {
          "Version": "2012-10-17",
          "Statement": [{
            "Effect": "Allow",
            "Action": [
              "logs:CreateLogStream",
              "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/cloudtrail/netacl-logs:*"
          }]
        }
        ```

        ```bash theme={null}
        aws iam put-role-policy \
          --role-name CloudTrail_CloudWatchLogs_Role \
          --policy-name CloudTrail_CloudWatchLogs_Policy \
          --policy-document file://cloudtrail-cwlogs-policy.json
        ```

        ### 1.3 Create / update CloudTrail to use that log group

        ```bash theme={null}
        aws cloudtrail create-trail \
          --name "OrgTrail" \
          --s3-bucket-name "my-cloudtrail-bucket" \
          --is-multi-region-trail \
          --cloud-watch-logs-log-group-arn "arn:aws:logs:us-east-1:123456789012:log-group:/aws/cloudtrail/netacl-logs" \
          --cloud-watch-logs-role-arn "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
        ```

        Enable logging (if not already):

        ```bash theme={null}
        aws cloudtrail start-logging --name "OrgTrail"
        ```

        ***

        ## 2. Create a CloudWatch Logs Metric Filter for NACL changes

        Create a filter pattern file `nacl-filter-pattern.txt`:

        ```text theme={null}
        { ($.eventSource = "ec2.amazonaws.com") && (
            ($.eventName = "CreateNetworkAcl") ||
            ($.eventName = "CreateNetworkAclEntry") ||
            ($.eventName = "DeleteNetworkAcl") ||
            ($.eventName = "DeleteNetworkAclEntry") ||
            ($.eventName = "ReplaceNetworkAclEntry") ||
            ($.eventName = "ReplaceNetworkAclAssociation")
          )
        }
        ```

        Then create the metric filter:

        ```bash theme={null}
        aws logs put-metric-filter \
          --log-group-name "/aws/cloudtrail/netacl-logs" \
          --filter-name "NetworkAclChangeFilter" \
          --filter-pattern file://nacl-filter-pattern.txt \
          --metric-transformations \
              metricName="NetworkAclChanges",metricNamespace="SecurityMonitoring",metricValue="1"
        ```

        ***

        ## 3. Create a CloudWatch alarm on the metric

        Example: alarm when at least 1 NACL change occurs in a 5‑minute period.

        ```bash theme={null}
        aws cloudwatch put-metric-alarm \
          --alarm-name "NetworkAclChangesAlarm" \
          --alarm-description "Alarm when Network ACLs are created, modified, or deleted" \
          --metric-name "NetworkAclChanges" \
          --namespace "SecurityMonitoring" \
          --statistic Sum \
          --period 300 \
          --evaluation-periods 1 \
          --threshold 1 \
          --comparison-operator GreaterThanOrEqualToThreshold \
          --treat-missing-data notBreaching \
          --alarm-actions "arn:aws:sns:us-east-1:123456789012:SecurityAlerts"
        ```

        (Ensure the SNS topic exists and subscriptions are confirmed.)

        ***

        ## 4. Validate

        * Generate a test NACL change (e.g., add/remove an entry).
        * Confirm:
          * The CloudTrail event appears in the log group.
          * The metric `NetworkAclChanges` increments.
          * `NetworkAclChangesAlarm` transitions to `ALARM` and SNS notification is sent.
      </Accordion>

      <Accordion title="Using Python">
        To fix this, you need to (1) ensure NACL changes are logged by CloudTrail, (2) create a CloudWatch Logs metric filter for those events, and (3) create a CloudWatch alarm on that metric. Below is a concise, step-by-step Python (boto3) example.

        Assumptions:

        * You already have:
          * A CloudTrail trail delivering logs to a CloudWatch Logs log group (e.g., `/aws/cloudtrail/logs`)
          * An SNS topic ARN to notify (e.g., `arn:aws:sns:us-east-1:123456789012:security-notifications`)

        Replace all placeholder values with your actual ones.

        ***

        ### 1. Make sure CloudTrail logs to CloudWatch Logs

        If your trail is not yet configured to send to CloudWatch Logs:

        ```python theme={null}
        import boto3

        cloudtrail = boto3.client('cloudtrail')

        trail_name = "my-org-trail"
        log_group_arn = "arn:aws:logs:us-east-1:123456789012:log-group:/aws/cloudtrail/logs:*"
        role_arn = "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"

        cloudtrail.update_trail(
            Name=trail_name,
            CloudWatchLogsLogGroupArn=log_group_arn,
            CloudWatchLogsRoleArn=role_arn
        )
        ```

        Ensure the IAM role has permissions to write to that log group.

        ***

        ### 2. Create a CloudWatch Logs metric filter for NACL changes

        Events to monitor (CloudTrail `eventName`):\
        `CreateNetworkAcl`, `CreateNetworkAclEntry`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `ReplaceNetworkAclEntry`, `ReplaceNetworkAclAssociation`

        ```python theme={null}
        import boto3

        logs = boto3.client('logs')

        log_group_name = "/aws/cloudtrail/logs"   # your log group
        metric_filter_name = "NACLChangesFilter"
        metric_namespace = "Security/NACL"
        metric_name = "NACLChanges"

        # Filter pattern that matches any of the listed eventName values
        filter_pattern = (
            '{ ($.eventSource = "ec2.amazonaws.com") && '
            '($.eventName = "CreateNetworkAcl" || '
            '$.eventName = "CreateNetworkAclEntry" || '
            '$.eventName = "DeleteNetworkAcl" || '
            '$.eventName = "DeleteNetworkAclEntry" || '
            '$.eventName = "ReplaceNetworkAclEntry" || '
            '$.eventName = "ReplaceNetworkAclAssociation") }'
        )

        logs.put_metric_filter(
            logGroupName=log_group_name,
            filterName=metric_filter_name,
            filterPattern=filter_pattern,
            metricTransformations=[
                {
                    "metricName": metric_name,
                    "metricNamespace": metric_namespace,
                    "metricValue": "1"
                }
            ]
        )
        ```

        ***

        ### 3. Create a CloudWatch alarm on that metric

        ```python theme={null}
        import boto3

        cloudwatch = boto3.client('cloudwatch')

        alarm_name = "NACLChangesAlarm"
        sns_topic_arn = "arn:aws:sns:us-east-1:123456789012:security-notifications"

        cloudwatch.put_metric_alarm(
            AlarmName=alarm_name,
            AlarmDescription="Alarm when Network ACL changes are detected via CloudTrail",
            Namespace="Security/NACL",
            MetricName="NACLChanges",
            Statistic="Sum",
            Period=300,                    # 5 minutes
            EvaluationPeriods=1,
            Threshold=1.0,                 # Trigger if >=1 change in the period
            ComparisonOperator="GreaterThanOrEqualToThreshold",
            AlarmActions=[sns_topic_arn],
            TreatMissingData="notBreaching"
        )
        ```

        ***

        ### 4. (Optional) Verify the configuration

        You can list the metric filters and alarms to verify:

        ```python theme={null}
        logs.describe_metric_filters(
            logGroupName=log_group_name,
            filterNamePrefix=metric_filter_name
        )

        cloudwatch.describe_alarms(
            AlarmNames=[alarm_name]
        )
        ```

        Once this is in place, any NACL change recorded in CloudTrail will produce a CloudWatch metric data point and trigger the alarm, sending a notification via SNS.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # CloudTrail log group that already receives your CloudTrail events
        # Replace EXISTING_CLOUDTRAIL_LOG_GROUP_NAME with your actual log group name.
        resource "aws_cloudwatch_log_group" "cloudtrail" {
          name = "EXISTING_CLOUDTRAIL_LOG_GROUP_NAME"
        }

        # Metric filter for Network ACL changes
        resource "aws_cloudwatch_log_metric_filter" "network_acl_changes" {
          name           = "NetworkAclChanges"
          log_group_name = aws_cloudwatch_log_group.cloudtrail.name

          # Matches Create/Delete/Replace Network ACL and entries
          pattern = "{($.eventName=CreateNetworkAcl) || ($.eventName=CreateNetworkAclEntry) || ($.eventName=DeleteNetworkAcl) || ($.eventName=DeleteNetworkAclEntry) || ($.eventName=ReplaceNetworkAclAssociation) || ($.eventName=ReplaceNetworkAclEntry)}"

          metric_transformation {
            name      = "NetworkAclChangesMetric"
            namespace = "CloudTrailMetrics"
            value     = "1"
          }
        }

        # CloudWatch alarm for Network ACL changes
        # Replace EXISTING_SNS_TOPIC_ARN with the ARN of your SNS topic for notifications.
        resource "aws_cloudwatch_metric_alarm" "network_acl_changes_alarm" {
          alarm_name          = "NetworkAclChangesAlarm"
          alarm_description   = "Triggers when an API call is made to create, delete, or change a Network ACL"
          namespace           = "CloudTrailMetrics"
          metric_name         = aws_cloudwatch_log_metric_filter.network_acl_changes.metric_transformation[0].name
          statistic           = "Sum"
          period              = 300
          threshold           = 1
          comparison_operator = "GreaterThanOrEqualToThreshold"
          evaluation_periods  = 1

          alarm_actions = [
            "EXISTING_SNS_TOPIC_ARN", # replace with your SNS Topic ARN
          ]

          depends_on = [
            aws_cloudwatch_log_metric_filter.network_acl_changes,
          ]
        }
        ```

        Notes:

        * This creates a new metric filter and CloudWatch alarm, matching the provided CLI remediation.
        * You must have an existing SNS topic for `EXISTING_SNS_TOPIC_ARN`, and you must subscribe an endpoint (e.g., email) to that topic manually in AWS or via separate Terraform.

        Verification with `terraform plan` should show:

        * `aws_cloudwatch_log_metric_filter.network_acl_changes` to be created (or updated if it already exists but differs).
        * `aws_cloudwatch_metric_alarm.network_acl_changes_alarm` to be created (or updated if it already exists but differs).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>