Module: cloudtrail-cloudwatch-alarms

Terraform module for creating alarms for tracking important changes and occurances from cloudtrail.

This module creates a set of filter metrics and alarms based on the security best practices covered in the AWS CIS Foundations Benchmark guide.

Usage

module "metric_configs" {
  source  = "cloudposse/config/yaml"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  map_config_local_base_path = "./catalog"
  map_config_paths           = "*.yaml"

  context = module.this.context
}

module "cloudtrail_api_alarms" {
  source  = "cloudposse/cloudtrail-cloudwatch-alarms/aws"
  # Cloud Posse recommends pinning every module to a specific version
  # version     = "x.x.x"

  log_group_name = "${aws_cloudwatch_log_group.default.name}"
  metrics = module.metric_configs.map_configs
}

For detailed usage which includes setting up cloudtrail, cloudwatch logs, roles, policies, and the s3 bucket - as well as using this module see the example directory

For aditional CIS rules and controls https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html#securityhub-cis-controls-3.8

Examples

Here's a complete example of using this terraform-aws-cloudtrail-cloudwatch-alarms module.

Metrics Tracked

Alarm's Name	Description
AuthorizationFailureCount	Alarms when an unauthorized API call is made.
S3BucketActivityEventCount	Alarms when an API call is made to S3 to put or delete a Bucket, Bucket Policy or Bucket ACL.
SecurityGroupEventCount	Alarms when an API call is made to create, update or delete a Security Group.
NetworkAclEventCount	Alarms when an API call is made to create, update or delete a Network ACL.
GatewayEventCount	Alarms when an API call is made to create, update or delete a Customer or Internet Gateway.
VpcEventCount	Alarms when an API call is made to create, update or delete a VPC, VPC peering connection or VPC connection to classic.
EC2InstanceEventCount	Alarms when an API call is made to create, terminate, start, stop or reboot an EC2 instance.
EC2LargeInstanceEventCount	Alarms when an API call is made to create, terminate, start, stop or reboot a 4x-large or greater EC2 instance.
CloudTrailEventCount	Alarms when an API call is made to create, update or delete a .cloudtrail. trail, or to start or stop logging to a trail.
ConsoleSignInFailureCount	Alarms when an unauthenticated API call is made to sign into the console.
IAMPolicyEventCount	Alarms when an API call is made to change an IAM policy.
ConsoleSignInWithoutMfaCount	Alarms when a user logs into the console without MFA.
RootAccountUsageCount	Alarms when a root account usage is detected.
KMSKeyPendingDeletionErrorCount	Alarms when a customer created KMS key is pending deletion.
AWSConfigChangeCount	Alarms when AWS Config changes.
RouteTableChangesCount	Alarms when route table changes are detected.

Dashboard Created

Two CloudWatch Dashboards can be created as well, and will be automatically created by default.

Credits

The alarm metric names, descriptions, and filters from this repository were used.

With many thanks to Anton Babenko for pointing it out and saving us a lot of time scouring reference documents and describing alarms!