Rule: Ensure a log metric filter and alarm for CMKs

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify the log metric filter configuration.
4. 2.
   Check the filter pattern to ensure it correctly captures disabling or scheduled deletion activities related to CMKs.
6. 3.
   Ensure the log metric filter is correctly associated with the appropriate log group(s) within the CIS_V140 environment.
8. 4.
   Review the alarm configuration and make sure the threshold settings are appropriate.
10. 5.
    Verify that the IAM role associated with the alarm has sufficient permissions to trigger actions in response to the alarm.
12. 6.
    Check the actions triggered by the alarm to ensure they are defined correctly.
14. 7.
    Verify that the SNS topic subscription, if used, is correctly set up and active.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.
   Login to the AWS Management Console.
4. 2.
   Navigate to the CloudWatch service.
6. 3.
   Select the desired region where the CIS_V140 environment is located.
8. 4.
   Go to the Logs section and find the log group(s) relevant to CMKs.
10. 5.
    Click on the log group to open the log streams.
12. 6.
    Create a new log metric filter by clicking on "Create metric filter".
14. 7.
    Define a filter pattern that captures disabling or scheduled deletion activities related to CMKs.
16. 8.
    Configure the filter to match the log group(s) associated with CMK actions in the CIS_V140 environment.
18. 9.
    Choose the appropriate metric namespace and name for the filter.
20. 10.
    Save the log metric filter.
22. 11.
    Go to the Alarms section in CloudWatch.
24. 12.
    Click on "Create alarm" to define a new alarm.
26. 13.
    In the "Create Alarm" wizard, select the metric filter created in step 10.
28. 14.
    Specify the threshold settings for the alarm, such as the number of occurrences or the period of time.
30. 15.
    Configure the actions to be triggered when the alarm threshold is breached. This can include sending notifications via SNS or triggering AWS Lambda functions.
32. 16.
    Save the alarm configuration.
34. 17.
    Test the setup by simulating a disabling or scheduled deletion of a customer-created CMK within the CIS_V140 environment.
36. 18.
    Monitor the CloudWatch metrics and verify that the log metric filter triggers the alarm as expected.
38. 19.
    Verify that the appropriate actions are triggered by the alarm, such as sending notifications or executing Lambda functions.
40. 20.
    Make any necessary adjustments to the log metric filter, alarm threshold, or actions based on testing and monitoring results.