Cloudwatch log metric filter and alarm should be set for Config configuration changes

Description

A CloudWatch metric filter and alarm should be established for detecting changes to AWS Config configuration. Monitoring changes to AWS Config configuration will help ensure sustained visibility of configuration items within the AWS account.

Console Remediation Steps

  • Navigate to Cloudwatch.

  • In the navigation pane, choose Logs.

  • In the list of log groups, select the check box next to the log group that you created for CloudTrail log events.

  • Choose Create Metric Filter.

  • On the Define Logs Metric Filter screen, choose Filter Pattern and then type the following: { ($.eventSource = config.amazonaws.com) && (($.eventName = StopConfigurationRecorder)||($.eventName = DeleteDeliveryChannel)||($.eventName = PutDeliveryChannel)||($.eventName = PutConfigurationRecorder)) }

  • For Metric Namespace, type CloudTrailMetrics.

  • For Metric Name, type AWSConfigChanges.

  • Choose Show advanced metric settings.

  • For Metric Value, type 1.

  • Choose Create Filter.

  • Create an Alarm.

  • After you create the metric filter, follow this procedure to create an alarm.

  • On the Filters for Log_Group_Name page, next to the CloudTrailMetrics filter name, choose Create Alarm.

  • On the Create Alarm page, provide the following values. Name: S3 Bucket Activity, is >= 1, for: 1 consecutive period, Period: 5 minutes, Statistic: sum, Send notificiation to: NotifyMe, Email list: email list.

CLI Remediation Steps

  • Create the metric filter for AWS Config changes:

    • aws logs put-metric-filter --log-group-name <name> --filter-name <name> --filter-pattern '{ ($.eventSource = config.amazonaws.com) && (($.eventName = StopConfigurationRecorder)||($.eventName = DeleteDeliveryChannel)||($.eventName = PutDeliveryChannel)||($.eventName = PutConfigurationRecorder)) } --metric-transformations metricName=ConfigEventCount,metricNamespace=CloudTrailMetrics,metricValue=1

  • Create the alarm:

    • aws cloudwatch put-metric-alarm --alarm-name AWSConfigChangesAlarm --alarm-description <description> --metric-name ConfigEventCount --namespace CloudTrailMetrics --statistic Sum --comparison-operator GreaterThanOrEqualToThreshold --evaluation-periods 1 --period 300 --threshold 1 --actions-enabled --alarm-actions <sns arn>