Ensure a Log Metric Filter and Alarm Exist for Disabling or Scheduled Deletion of Customer Created CMKs Rule

Rule Description: Log Metric Filter and Alarm for Disabling or Scheduled Deletion of Customer Created CMKs

Policy Details:

2. 1.
   Policy ID: cis_v130_cmk_disable_scheduled_deletion
4. 2.
   Description: This policy ensures the presence of a log metric filter and alarm to monitor and alert on any interactions related to disabling or scheduling deletion of customer created CMKs.
6. 3.
   Compliance Standards: CIS AWS Foundation Benchmark v1.3.0

Rule Remediation:

Step 1: Create a Log Metric Filter:

2. 1.

   Go to the Amazon CloudWatch console: https://console.aws.amazon.com/cloudwatch/.

4. 2.

   In the navigation pane, click on "Log groups" and locate the relevant CloudTrail log group (e.g.,

   /aws/cloudtrail/<your-cloudtrail-log-group>

   ).

6. 3.

   Click on the log group to open its details.

8. 4.

   In the "Actions" dropdown, select "Create Metric Filter."

10. 5.

    Specify a filter pattern that will match the CMK disable or scheduled deletion events. For example, you can use the following pattern:

    {($.eventName = "DisableKey" || $.eventName = "ScheduleKeyDeletion") && $.errorString NOT EXISTS && $.additionalEventData.principalId NOT EXISTS}
    

    This pattern captures the events where a customer user (

    $.additionalEventData.principalId

    ) disables or schedules deletion of a CMK.

12. 6.

    Click on "Assign Metric" and create a new metric namespace with an appropriate name, like

    CMKDisableDeleteMetric

    .

14. 7.

    Choose a metric value, such as

    1

    , to indicate each occurrence of the filter pattern.

16. 8.

    Click on "Create Filter."

Step 2: Create an Alarm for the Log Metric Filter:

2. 1.
   In the CloudWatch console, click on the "Alarms" section in the navigation pane.
4. 2.
   Click on the "Create Alarm" button.
6. 3.
   Under the "Create Alarm" tab, choose "Select metric"
8. 4.
   Search for the metric namespace created in Step 1, e.g.,

   CMKDisableDeleteMetric

   , and select it.
10. 5.
    Define the conditions for the alarm based on your specific requirements. For example, you can set the "Threshold type" to "Static" and specify a threshold value of

    1

    to trigger the alarm for every occurrence of the filter.
12. 6.
    Configure the actions to be taken when the alarm is triggered (e.g., sending notifications via email, SNS topic, etc.).
14. 7.
    Click on "Create Alarm."

Troubleshooting Steps:

2. 1.
   Ensure that CloudTrail logging is enabled for the region where the CMKs are created or deleted.
4. 2.
   Check if the log group associated with CloudTrail is correctly specified in the log metric filter.
6. 3.
   Verify that the filter pattern used in the log metric filter matches the events representing CMK disable or scheduled deletion correctly.
8. 4.
   Confirm that the alarm threshold is set appropriately, considering the expected frequency of CMK disable or deletion events.
10. 5.
    Review the CloudWatch metrics and logs for any errors or inconsistencies.

Related CLI Commands: