Ensure a Log Metric Filter and Alarm Rule for CMK Disabling or Deletion

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify that you have the necessary permissions to create CloudWatch log metric filters and alarms.
4. 2.
   Log in to the AWS Management Console.
6. 3.
   Go to the CloudWatch service.
8. 4.
   Open the "Log Groups" section.
10. 5.
    Locate the appropriate log group that contains the logs for the AWS Key Management Service (KMS).
12. 6.
    Click on the log group to open its details.
14. 7.
    In the "Actions" dropdown menu, select "Create Metric Filter."
16. 8.
    Define the following filter pattern:

    • Filter pattern: {($.eventName = DisableKey || $.eventName = ScheduleKeyDeletion) && $.eventSource = kms.amazonaws.com && $.requestParameters.keyId}
    • Example: {($.eventName = DisableKey || $.eventName = ScheduleKeyDeletion) && $.eventSource = kms.amazonaws.com && $.requestParameters.keyId}
18. 9.
    Click on "Assign Metric" and create a new metric with a meaningful name.
20. 10.
    Specify the namespace as "CloudTrailMetrics" or any other appropriate namespace.
22. 11.
    Set the metric value to "1" for each matching log event.
24. 12.
    Click on "Create Filter" to save the log metric filter.
26. 13.
    After creating the log metric filter, navigate to the CloudWatch console and select the "Alarms" section.
28. 14.
    Click on "Create Alarm."
30. 15.
    Under the "Select metric" section, choose the metric you created in the previous step.
32. 16.
    Configure the alarm threshold to trigger whenever the metric value is greater than zero.
34. 17.
    Specify the actions to be taken when the alarm is triggered, such as sending notifications or triggering automated remediation processes.
36. 18.
    Review and save the alarm configuration.

Code:

Resources:
  CMKLogMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: "/aws/kms/your-log-group-name"
      FilterPattern: "{($.eventName = DisableKey || $.eventName = ScheduleKeyDeletion) && $.eventSource = kms.amazonaws.com && $.requestParameters.keyId}"
      MetricTransformations:
        - MetricName: "CMKDisableDeleteMetric"
          ValueType: "Sum"
          Value: "1"
          Namespace: "CloudTrailMetrics"

  CMKLogMetricFilterAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: "CMKDisableDeleteAlarm"
      AlarmDescription: "Alarm for detecting disabling or scheduled deletion of customer created CMKs"
      Namespace: "CloudTrailMetrics"
      MetricName: "CMKDisableDeleteMetric"
      ComparisonOperator: "GreaterThanThreshold"
      Statistic: "SampleCount"
      Threshold: 0
      Period: 300
      EvaluationPeriods: 1
      AlarmActions:
        - "arn:aws:sns:your-sns-topic-arn"

"your-log-group-name"

"your-sns-topic-arn"

Remediation Steps:

2. 1.
   Review the alarm details to gather information about the CMK that has been disabled or scheduled for deletion.
4. 2.
   Identify the user or actor responsible for the action and ensure it was authorized.
6. 3.
   If the action was unauthorized, revoke any associated IAM privileges for the user or actor.
8. 4.
   Determine the impact of the disabled or scheduled deletion of the CMK.
10. 5.
    If necessary, restore the CMK from a backup or create a new CMK to replace the disabled or deleted one.
12. 6.
    Implement additional measures, such as enabling AWS CloudTrail logging and reviewing security best practices, to prevent similar incidents in the future.