Project: KICS (Provisioning / Security & Compliance)
File: 27c6a499-895a-4dc7-9617-5c485218db13.md

title: CloudWatch S3 policy Change Alarm Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 27c6a499-895a-4dc7-9617-5c485218db13 Query name: CloudWatch S3 policy Change Alarm Missing Platform: Terraform Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Ensure a log metric filter and alarm exist for S3 bucket policy changes<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1 3 30" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") || (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "ciss3bucketpolicychangecw_alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metric_name = "XXX NOT YOUR FILTER" namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisnomfaconsolesigninmetricfilter" { name = "CIS-ConsoleSigninWithoutMFA" pattern = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-ConsoleSigninWithoutMFA" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnomfaconsolesignincw_alarm" { alarm_name = "CIS-3.2-ConsoleSigninWithoutMFA" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisnomfaconsolesigninmetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="3" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") && (($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "CISS3BucketPolicyChangeCW_Alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.ciss3bucketpolicychangemetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="3" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "CISS3BucketPolicyChangeCW_Alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.ciss3bucketpolicychangemetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` <details><summary>Positive test

4 - tf file</summary> ```tf hl_lines="3" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ $.eventSource = \"s3.amazonaws.com\" }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "CISS3BucketPolicyChangeCW_Alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.ciss3bucketpolicychangemetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` </details> <details><summary>Positive test num. 5 - tf file</summary> ```tf hl_lines="4 31" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") || (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "ciss3bucketpolicychangecw_alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.ciss3bucketpolicychangemetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisnomfaconsolesigninmetricfilter" { name = "CIS-ConsoleSigninWithoutMFA" pattern = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-ConsoleSigninWithoutMFA" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnomfaconsolesignincw_alarm" { alarm_name = "CIS-3.2-ConsoleSigninWithoutMFA" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisnomfaconsolesigninmetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` </details> ```tf title="Negative test num. 1 - tf file" resource "awscloudwatchlogmetricfilter" "ciss3bucketpolicychangemetricfilter" { name = "CIS-S3BucketPolicyChanges" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-S3BucketPolicyChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "ciss3bucketpolicychangecw_alarm" { alarm_name = "CIS-3.8-S3BucketPolicyChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.ciss3bucketpolicychangemetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to S3 bucket policies may reduce time to detect and correct permissive policies on sensitive S3 buckets." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisnomfaconsolesigninmetricfilter" { name = "CIS-ConsoleSigninWithoutMFA" pattern = "{ ($.eventSource = \"s3.amazonaws.com\") && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication)) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-ConsoleSigninWithoutMFA" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnomfaconsolesignincw_alarm" { alarm_name = "CIS-3.2-ConsoleSigninWithoutMFA" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisnomfaconsolesigninmetric_filter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring for single-factor console logins will increase visibility into accounts that are not protected by MFA." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ```