Ensure a Log Metric Filter and Alarm Exist for Usage of 'root' Account Rule

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify Log Metric Filter: Check if a log metric filter exists to capture 'root' account usage data.
4. 2.
   Confirm Alarm Configuration: Ensure that an alarm is associated with the log metric filter to trigger an alert when 'root' account usage exceeds the defined threshold.
6. 3.
   Check Alarm Actions: Validate that the alarm actions are set up correctly to notify the appropriate stakeholders when an alert is triggered.
8. 4.
   Review Alarm Thresholds: Verify if the alarm threshold is appropriately defined to reflect the acceptable usage limits for the 'root' account as per GDPR compliance requirements.
10. 5.
    Check Data Filters: Make sure that the log metric filter includes specific data filters to monitor 'root' account activity accurately.
12. 6.
    Inspect Logging Permissions: Ensure that the required permissions are assigned to the user/group responsible for accessing log metric filters and alarms.

Necessary Code:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "RootAccountMetricFilter": {
      "Type": "AWS::Logs::MetricFilter",
      "Properties": {
        "LogGroupName": "<log-group-name>",
        "FilterPattern": "{($.userIdentity.userName = 'root') || ($.userIdentity.arn = 'arn:aws:iam::*:root')}",
        "MetricTransformations": [
          {
            "MetricValue": "1",
            "MetricNamespace": "<metric-namespace>",
            "MetricName": "<metric-name>"
          }
        ]
      }
    }
  }
}

Remediation Steps:

2. 1.
   Step 1: Log in to the cloud platform console with appropriate credentials.
4. 2.
   Step 2: Navigate to the logging/monitoring service (e.g., AWS CloudWatch Logs).
6. 3.
   Step 3: Locate the relevant log group or create a new one dedicated to 'root' account monitoring.
8. 4.
   Step 4: Create a new log metric filter within the chosen log group.
10. 5.
    Step 5: Specify the filter pattern as "{($.userIdentity.userName = 'root') || ($.userIdentity.arn = 'arn:aws:iam::*:root')}" to capture 'root' account activities.
12. 6.
    Step 6: Choose a meaningful metric namespace and name for the metric filter.
14. 7.
    Step 7: Save the log metric filter configuration.
16. 8.
    Step 8: Set up an alarm associated with the log metric filter.
18. 9.
    Step 9: Configure the alarm threshold based on GDPR compliance requirements and acceptable 'root' account usage limits.
20. 10.
    Step 10: Define appropriate actions for the alarm, such as sending notifications to stakeholders via email or triggering automated remediation workflows.
22. 11.
    Step 11: Save the alarm configuration.
24. 12.
    Step 12: Regularly monitor the log metric filter and alarm to ensure continuous compliance with GDPR regulations.