Project: KICS (Provisioning / Security & Compliance)
File: 6b6874fe-4c2f-4eea-8b90-7cceaa4a125e.md

title: CloudWatch Network Gateways Changes Alarm Missing hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 6b6874fe-4c2f-4eea-8b90-7cceaa4a125e Query name: CloudWatch Network Gateways Changes Alarm Missing Platform: Terraform Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: Ensure a log metric filter and alarm exist for network gateways changes<br> ```tf title="Positive test num. 1 - tf file" hl_lines="1" resource "awscloudwatchlogmetricfilter" "cisnetworkgatewaychangesmetric_filter" { name = "CIS-NetworkGatewayChanges" pattern = "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-NetworkGatewayChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnetworkgatewaychangescwalarm" { alarm_name = "CIS-3.12-NetworkGatewayChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metric_name = "XXXX NOT YOUR FILTER XXXX" namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` ```tf title="Positive test num. 2 - tf file" hl_lines="1" resource "awscloudwatchlogmetricfilter" "cisunauthorizedapicallsmetric_filter" { name = "CIS-UnauthorizedAPICalls" pattern = "{ ($.errorCode = \"UnauthorizedOperation\") || ($.errorCode = \"AccessDenied\") }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-UnauthorizedAPICalls" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisunauthorizedapicallscwalarm" { alarm_name = "CIS-3.1-UnauthorizedAPICalls" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisunauthorizedapicallsmetricfilter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity." alarmactions = [awssnstopic.cisalertssnstopic.arn] insufficientdataactions = [] } ``` ```tf title="Positive test num. 3 - tf file" hl_lines="1" resource "awscloudwatchlogmetricfilter" "cisnetworkgatewaychangesmetric_filter" { name = "CIS-NetworkGatewayChanges" pattern = "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DetachInternetGateway) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-NetworkGatewayChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnetworkgatewaychangescwalarm" { alarm_name = "CIS-3.12-NetworkGatewayChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisnetworkgatewaychangesmetricfilter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ``` ```tf title="Negative test num. 1 - tf file" resource "awscloudwatchlogmetricfilter" "cisnetworkgatewaychangesmetric_filter" { name = "CIS-NetworkGatewayChanges" pattern = "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }" loggroupname = awscloudwatchloggroup.CISCloudWatch_LogsGroup.name metric_transformation { name = "CIS-NetworkGatewayChanges" namespace = "CISMetricAlarm_Namespace" value = "1" } } resource "awscloudwatchmetricalarm" "cisnetworkgatewaychangescwalarm" { alarm_name = "CIS-3.12-NetworkGatewayChanges" comparison_operator = "GreaterThanOrEqualToThreshold" evaluation_periods = "1" metricname = awscloudwatchlogmetricfilter.cisnetworkgatewaychangesmetricfilter.id namespace = "CISMetricAlarm_Namespace" period = "300" statistic = "Sum" threshold = "1" alarm_description = "Monitoring changes to network gateways will help ensure that all ingress/egress traffic traverses the VPC border via a controlled path." alarmactions = [awssnstopic.CISAlertsSNSTopic.arn] insufficientdataactions = [] } ```