Rule: Ensure a log metric filter and alarm for AWS Management Console sign-in without MFA

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify that an AWS CloudTrail is enabled in your AWS account.
4. 2.
   Ensure that all users are required to use MFA for console sign-in.
6. 3.
   Check that a log metric filter and alarm exist for detecting sign-ins without MFA.

Necessary Codes:

Resources:
  LogMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref LogGroupName
      FilterPattern: '{ ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") }'
      MetricTransformations:
        - MetricName: UnauthorizedConsolesWithoutMFA
          MetricNamespace: SigninMetrics
          MetricValue: "1"
          DefaultValue: 0

  Alarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: UnauthorizedConsolesWithoutMFAAlarm
      AlarmDescription: "Alarm triggered when unauthorized consoles are used without MFA"
      ComparisonOperator: GreaterThanThreshold
      EvaluationPeriods: 1
      Threshold: 0
      MetricName: UnauthorizedConsolesWithoutMFA
      Namespace: SigninMetrics
      Period: 300
      AlarmActions:
        - <ARN of the SNS topic or AWS Lambda function to notify>
      Dimensions:
        - Name: Username
          Value: <Your AWS account username>

<ARN of the SNS topic or AWS Lambda function to notify>

<Your AWS account username>

aws logs put-metric-filter --log-group-name <LogGroupName> --filter-name UnauthorizedConsolesWithoutMFAFilter --filter-pattern '{ ($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") }' --metric-transformations metricName=UnauthorizedConsolesWithoutMFA,metricNamespace=SigninMetrics,metricValue=1 --default-value 0

aws cloudwatch put-metric-alarm --alarm-name UnauthorizedConsolesWithoutMFAAlarm --alarm-description "Alarm triggered when unauthorized consoles are used without MFA" --comparison-operator GreaterThanThreshold --evaluation-periods 1 --threshold 0 --period 300 --alarm-actions <ARN of the SNS topic or AWS Lambda function to notify> --namespace SigninMetrics --metric-name UnauthorizedConsolesWithoutMFA --dimensions Name=Username,Value=<Your AWS account username>

<LogGroupName>

<ARN of the SNS topic or AWS Lambda function to notify>

<Your AWS account username>

Step-by-Step Guide for Remediation:

2. 1.
   Sign in to the AWS Management Console and open the AWS CloudFormation service.
4. 2.
   Click on "Create stack" to create a new CloudFormation stack.
6. 3.
   Select "Upload a template file" and upload the CloudFormation template code provided above.
8. 4.
   Click on "Next" to proceed.
10. 5.
    Provide a stack name and fill in any necessary parameters.
12. 6.
    In the "Capabilities" section, check the box for acknowledging the creation of IAM resources.
14. 7.
    Click on "Next" and then "Create stack" to create the CloudFormation stack.
16. 8.
    Wait for the stack creation to complete. This may take a few minutes.
18. 9.
    Once the stack creation is complete, you will have a log metric filter and alarm set up to detect AWS Management Console sign-ins without MFA.
20. 10.
    To test the setup, try signing in to the AWS Management Console without enabling MFA. You should receive an alarm notification indicating that an unauthorized sign-in without MFA has been detected.
22. 11.
    If needed, you can configure the alarm to notify the appropriate individuals or teams by modifying the alarm actions.