Rule: Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify AWS CloudTrail logging is enabled:

   • Go to the AWS Management Console.
   • Navigate to the CloudTrail service.
   • Ensure that CloudTrail is enabled for the AWS account.
4. 2.

   Check for existing metric filters and alarms:

   • Go to the AWS Management Console.
   • Navigate to the CloudWatch service.
   • Select "Logs" from the left-hand menu.
   • Look for an existing metric filter related to disabling or scheduled deletion of customer-managed keys.
   • Ensure that an alarm is associated with the metric filter.
6. 3.

   Validate the log metric filter's pattern:

   • Open the existing metric filter or create a new one.
   • Check the pattern used in the metric filter for accurate matching of disabling or scheduled deletion of customer-managed keys events.
   • Ensure the pattern properly captures the key events in the logs.
8. 4.

   Verify the associated alarm settings:

   • Open the associated alarm for the log metric filter.
   • Check if the alarm is correctly configured to trigger based on the defined threshold and evaluation period.
   • Ensure the alarm sends notifications to the appropriate recipient(s) for prompt action.

Necessary Codes:

Step-by-Step Guide for Remediation:

2. 1.

   Open the AWS Management Console.

4. 2.

   Navigate to the CloudWatch service.

6. 3.

   Select "Logs" from the left-hand menu.

8. 4.

   Click on the log group that contains the relevant CloudTrail logs.

10. 5.

    Select the "Actions" button and choose "Create metric filter."

12. 6.

    Define a filter pattern that matches disabling or scheduled deletion of customer-managed keys events. Example pattern:

    {($.eventSource = kms.amazonaws.com) && (($.eventName = DisableKey) || ($.eventName = ScheduleKeyDeletion))}
    

14. 7.

    Test the pattern to ensure it matches the desired events by using the provided log samples.

16. 8.

    Specify a name for the metric filter.

18. 9.

    Define the filter's destination as "Metric."

20. 10.

    Add a corresponding metric namespace and metric name to identify the filter's monitoring data accurately.

22. 11.

    Click on "Create filter."

24. 12.

    Once the filter is created, return to the log group page.

26. 13.

    Locate the created metric filter and click on the associated alarm link.

28. 14.

    Configure the alarm based on your desired threshold(s) and evaluation period.

30. 15.

    Define the action(s) to be taken when the alarm is triggered, such as sending a notification to relevant stakeholders.

32. 16.

    Click on "Create alarm."

34. 17.

    Test the alarm by generating appropriate events or wait for the regular logs to populate.

36. 18.

    Monitor the alarm for any triggering events related to disabling or scheduled deletion of customer-managed keys.