Monitoring user login through Cloudtrail for IAM Identity Center[AWS]
Published: 2023-09-07 15:29:56

**AWS IAM Identity Center** helps you securely create or connect your identities and manage their access centrally across AWS accounts and applications. IAM Identity Center is the recommended approach for workforce authentication and authorization on AWS for organizations of any size and type.

As there is no **lockout/notification** system for wrong login attempt in **IAM Identity Center**, so we will discuss how to configure a system by which we could be notified/get wrong login info.

> **Config Procedure:**

- Create a Cloudtrail in that AWS account where the IAM Identity center is configured
- Enable Cloudwatch log + Cloudwatch log group + S3 Storage location
- Create Cloudwatch Logs Metric Filter
- Create SNS and send alarm notifications.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/94szpkypzjuc8t0njkax.png)

**Creating Cloudtrail:**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oonl8lvm2msziuakrhg6.png)

**Event in Cloudtrail**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rkfe0cv9mzpbkvywcduj.png)

**Create Cloudwatch Metric Filter:**
Now we have to go to **Cloudwatch group** and set the metric by which Cloudwatch alert will be generated.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y7ilq29p7376apc198yo.png)

Add below pattern

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bydjak4gpnvd4wm85f1y.png)

```
{ $.eventSource = "signin.amazonaws.com" && $.serviceEventDetails.CredentialVerification = "Failure" }
```
After setting the pattern, you could test the pattern at the time of metric creation.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y14jen5wn9eh1r4qta40.png)
Now we need to put some values for the **metric**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gdscl04rzh8lu5hpc09r.png)
Save the changes, so metric will be created and it's time to create a cloudwatch alarm.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3ycc87l4rvqe0cyqamze.png)
Now we set like below to set the threshold values for login attempts.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qfr8wrwry8yifr1g2yfo.png)
Set **conditions **per requirements and press "**next**"

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/76bgi1sh7xvxeegdq0o9.png)
it's time to set **notification policies** with **SNS**. 

> Before that we need create a **SNS **with email endpoint to get the alert to the mail.
> How to create SNS:
> ==================
> - Create SNS with email `subscription`
> - First create a topic with **standard **type. Give a name and description.
> - After creating the "topic", go to that topic.
> - Create a "**Subscription**" where protocol "**Email**" and set the **endpoint ** [email address]to which we want to get the email.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oylue0ecxlkxam8cnfht.png)

So, we will get alert mail like below if any wrong attempt for login crosses the threshold value.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2ccno1pcyneau72xw3pl.png)