Project: KICS (Provisioning / Security & Compliance)
File: 38b85c45-e772-4de8-a247-69619ca137b3.md

title: CloudWatch AWS Organizations Changes Missing Alarm hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 38b85c45-e772-4de8-a247-69619ca137b3 Query name: CloudWatch AWS Organizations Changes Missing Alarm Platform: Terraform Severity: <span style="color:#5bc0de">Info</span> Category: Observability URL: Ensure a log metric filter and alarm exist for AWS organizations changes<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisaws_organizations" { alarm_name = "CIS-4.15-AWS-Organizations" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metric_name = "OTHER FILTER" namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisawsorganizations" { name = "CIS-4.15-AWS-Organizations" pattern = "{ ($.eventSource = \"organizations.amazonaws.com\") && (($.eventName = \"AcceptHandshake\") || ($.eventName = 'AttachPolicy') || ($.eventName = CreateAccount) || ($.eventName = PutBucketLifecycle) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUni)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.15-AWS-Organizations" namespace = "CISMetricAlarm_Namespace" value = "1" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisaws_organizations" { alarm_name = "CIS-4.15-AWS-Organizations" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisaws_organizations.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisawsorganizations" { name = "CIS-4.15-AWS-Organizations" pattern = "{ ($.eventSource = \"organizations.amazonaws.com\") && (($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = PutBucketLifecycle) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUni)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.15-AWS-Organizations" namespace = "CISMetricAlarm_Namespace" value = "1" } } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisaws_organizations" { alarm_name = "CIS-4.15-AWS-Organizations" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisaws_organizations.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisawsorganizations" { name = "CIS-4.15-AWS-Organizations" pattern = "{ ($.eventSource = \"organizations.amazonaws.com\") && (($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CreateAccount) || ($.eventName = PutBucketLifecycle) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUni)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.15-AWS-Organizations" namespace = "CISMetricAlarm_Namespace" value = "1" } } ```