Amazon_CloudWatch_5

Ensure a log metric filter and alarm exist for CloudTrail configuration changes

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for detecting changes to CloudTrail’s configurations.

Remediation

Perform the following to ensure a log metric filter and alarm exist for CloudTrail configuration changes

Note : Filter pattern for CloudTrail configuration changes

filterPattern”: “{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail) ||
($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName =
StopLogging) }”

Perform the following to setup the metric filter, alarm, SNS topic, and subscription:

  1. Identify the log group name configured for use with CloudTrail
  2. Note the &lt

Service

CloudWatch

Severity

Medium

Compliance

Mapping

We are now live on AWS Marketplace.
The integrated view of your cloud infrastructure is now easier than ever!