Project: KICS (Provisioning / Security & Compliance)
File: eaaba502-2f94-411a-a3c2-83d63cc1776d.md

title: CloudWatch IAM Policy Changes Alarm Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: eaaba502-2f94-411a-a3c2-83d63cc1776d Query name: CloudWatch IAM Policy Changes Alarm Missing Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Ensure a log metric filter and alarm exist for IAM policy changes<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisiampolicychange" { alarm_name = "CIS-4.4-IAM-Policy-Change" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metric_name = "XXXX NOT YOUR FILTER XXXX" namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisiampolicy_change" { name = "CIS-4.4-IAM-Policy-Change" pattern = "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.4-IAM-Policy-Change" namespace = "CISMetricAlarm_Namespace" value = "1" } } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisiampolicychange" { alarm_name = "CIS-4.4-IAM-Policy-Change" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisiampolicychange.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisiampolicy_change" { name = "CIS-4.4-IAM-Policy-Change" pattern = "{($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.4-IAM-Policy-Change" namespace = "CISMetricAlarm_Namespace" value = "1" } } ``` ```tf title="Negative test num. 1 - tf file" provider "aws" { region = "us-east-2" } resource "awscloudwatchloggroup" "CISCloudWatch_LogsGroup" { name = "CISCloudWatchLogsGroup" } resource "awssnstopic" "cisalertssns_topic" { name = "cis-alerts-sns-topic" } resource "awscloudwatchmetricalarm" "cisiampolicychange" { alarm_name = "CIS-4.4-IAM-Policy-Change" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisiampolicychange.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } resource "awscloudwatchlogmetricfilter" "cisiampolicy_change" { name = "CIS-4.4-IAM-Policy-Change" pattern = "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-4.4-IAM-Policy-Change" namespace = "CISMetricAlarm_Namespace" value = "1" } } ```