Ensure a Log Metric Filter Rule for Unauthorized API Calls

Rule Description:

Troubleshooting Steps:

2. 1.
   Check if the required log metric filter and alarm are already configured.
4. 2.
   Verify the log sources and log streams are correctly configured.
6. 3.
   Ensure the appropriate permissions are granted to access and modify the log metric filter and alarm settings.
8. 4.
   Review the existing filter pattern to ensure it captures unauthorized API calls accurately.
10. 5.
    Verify if the alarm threshold and actions are correctly configured.

Necessary Codes:

{ $.errorCode = "*UnauthorizedOperation" }

Step-by-Step Guide for Remediation:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the CloudWatch service.
6. 3.
   Click on "Log Groups" from the left-hand sidebar.
8. 4.
   Select the appropriate log group where API access logs are stored.
10. 5.
    Click on "Create Metric Filter".
12. 6.
    In the "Filter Pattern" section, enter the filter pattern mentioned above.
14. 7.
    Click on "Assign metric".
16. 8.
    Specify a name and namespace for the metric filter.
18. 9.
    Choose a metric value like "1" to indicate unauthorized API calls.
20. 10.
    Click on "Create filter".
22. 11.
    Go back to the CloudWatch console and navigate to "Alarms" from the sidebar.
24. 12.
    Click on "Create alarm".
26. 13.
    In the "Create Alarm" wizard, choose "Select metric".
28. 14.
    Search and select the metric associated with the log filter created previously.
30. 15.
    Specify the alarm threshold based on the desired conditions for triggering the alarm.
32. 16.
    Configure the actions to be taken when the alarm is triggered (e.g., sending an email notification).
34. 17.
    Click on "Create alarm" to save the configuration.