Ensure a Log Metric Filter and Alarm Exist for Route Table Changes Rule

Rule Description: Log Metric Filter and Alarm for Route Table Changes for cis_v130

Rule Overview:

Rule Implementation:

Step 1: Create a Log Metric Filter

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the Amazon CloudWatch service.
6. 3.
   Select "Log groups" from the sidebar menu.
8. 4.
   Locate the log group associated with the cis_v130 environment.
10. 5.
    Click on the log group name to open the log group details.
12. 6.
    Choose the "Create metric filter" button.
14. 7.
    In the "Filter pattern" input field, enter the following CloudWatch Logs filter pattern: "eventSource = ec2.amazonaws.com AND eventName = CreateRoute OR eventName = ReplaceRoute OR eventName = DeleteRoute".
16. 8.
    Specify a name for the metric filter, such as "RouteTableChangesMetricFilter".
18. 9.
    In the "Create a new metric filter" section, configure the filter to extract the necessary fields (e.g., route table ID, VPC ID).
20. 10.
    Click on the "Test pattern" button to verify that the filter correctly matches the desired events.
22. 11.
    Select "Assign a new metric" and provide a name for the metric, such as "RouteTableChangesMetric".
24. 12.
    Choose a unit and define the metric value for aggregation (e.g., count, sum, average).
26. 13.
    Confirm the configuration by clicking on the "Create filter" button.

Step 2: Create an Alarm

2. 1.
   After creating the log metric filter, navigate to the Amazon CloudWatch service page.
4. 2.
   Click on "Alarms" in the sidebar menu.
6. 3.
   Select the "Create alarm" button.
8. 4.
   In the "Create alarm" wizard, select the "Select metric" button.
10. 5.
    Choose the "RouteTableChangesMetric" metric from the list.
12. 6.
    Define the threshold for the alarm based on the desired detection criteria (e.g., number of route table changes).
14. 7.
    Set the period, evaluation periods, and actions for the alarm as per your requirements.
16. 8.
    Provide a name and description for the alarm, such as "RouteTableChangesAlarm".
18. 9.
    Optionally, configure additional actions to be taken when the alarm state changes (e.g., sending notifications, triggering AWS Lambda functions).
20. 10.
    Click on the "Create alarm" button to finalize the alarm creation.

Troubleshooting Steps (if applicable):

2. 1.
   Verify that the log metric filter filter pattern is correctly defined as: "eventSource = ec2.amazonaws.com AND eventName = CreateRoute OR eventName = ReplaceRoute OR eventName = DeleteRoute".
4. 2.
   Ensure that the log group associated with the cis_v130 environment is correctly identified and selected when creating the metric filter.
6. 3.
   Double-check that the necessary fields are properly extracted and assigned when configuring the metric filter.
8. 4.
   Confirm that the log events with the relevant route table changes are present in the log group.
10. 5.
    Check if the alarm threshold and evaluation periods are appropriately set to detect route table changes.
12. 6.
    Verify that the actions associated with the alarm are correctly configured (e.g., notification recipients, AWS Lambda functions).

Additional Notes (if applicable):