AWS Log metric filter and alarm does  not exist for management console sign-in without MFA
This policy identifies the AWS regions that do not have a log metric filter and alarm for management console sign-in without MFA.

A log metric filter in AWS CloudWatch scans log data for specific patterns and generates metrics based on those patterns. Unauthorized access attempts may go undetected without a log metric filter and alarm for console sign-ins without MFA. This increases the risk of account compromise and potential data breaches due to inadequate security monitoring.

It is recommended that a metric filter and alarm be established for management console sign-in without MFA to increase visibility into accounts that are not protected by MFA.

NOTE: This policy will trigger an alert if you have at least one Cloudtrail with the multi-trail is enabled, Logs all management events in your account, and is not set with a specific log metric filter and alarm.
This is applicable to aws cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to the AWS Console.
2. Navigate to the CloudWatch dashboard.
3. Click on 'Log groups' in the 'Logs' section (Left panel)
4. Select the log group created for your CloudTrail trail event logs (Cloudtrail should be multi-trail enabled with all Management Events captured) and click the Actions Dropdown Button -> Click 'Create Metric Filter' button.
5. In the 'Define Pattern' page, add the 'Filter pattern' value as

{ ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") && ($.userIdentity.type = "IAMUser") && ($.responseElements.ConsoleLogin = "Success") }

and Click on 'NEXT'.
6. In the 'Assign Metric' page, Choose Filter Name, and Metric Details parameter according to your requirement and click on 'Next'.
7. Under the ‘Review and Create' page, Review details and click 'Create Metric Filter’.
8. To create an alarm based on a log group-metric filter, Refer to the below link 
    https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Create_alarm_log_group_metric_filter.html.

Query:
```config from cloud.resource where api.name = 'aws-logs-describe-metric-filters' as X; config from cloud.resource where api.name = 'aws-cloudwatch-describe-alarms' as Y; config from cloud.resource where api.name = 'aws-cloudtrail-describe-trails' as Z; filter '(($.Z.cloudWatchLogsLogGroupArn is not empty and $.Z.cloudWatchLogsLogGroupArn contains $.X.logGroupName and $.Z.isMultiRegionTrail is true and $.Z.includeGlobalServiceEvents is true) and (($.X.filterPattern contains "eventName=" or $.X.filterPattern contains "eventName =") and ($.X.filterPattern does not contain "eventName!=" and $.X.filterPattern does not contain "eventName !=") and $.X.filterPattern contains "ConsoleLogin" and ($.X.filterPattern contains "MFAUsed !=" or $.X.filterPattern contains "MFAUsed!=") and $.X.filterPattern contains "Yes" and ($.X.filterPattern contains "userIdentity.type =" or $.X.filterPattern contains "userIdentity.type=") and $.X.filterPattern contains "IAMUser" and ($.X.filterPattern contains "responseElements.ConsoleLogin =" or $.X.filterPattern contains "responseElements.ConsoleLogin=") and $.X.filterPattern contains "Success") and ($.X.metricTransformations[*] contains $.Y.metricName))'; show X; count(X) less than 1```