Ensure a Log Metric Filter and Alarm Exist for IAM Policy Changes Rule

Rule Description:

Troubleshooting Steps (if applicable):

2. 1.
   Verify that log metric filters and alarms are properly configured.
4. 2.
   Check if the filters are accurately capturing IAM policy changes.
6. 3.
   Ensure that notifications are set up correctly to receive alerts.
8. 4.
   Review the AWS CloudTrail and CloudWatch logs for any issues or errors.
10. 5.
    Validate the IAM policy changes against the NIST CSF v1 requirements.

Necessary Code (if applicable):

Step-by-Step Guide for Remediation:

Step 1: Configure Log Metric Filter

2. 1.
   Open the AWS Management Console and navigate to the CloudWatch service.
4. 2.
   Select the appropriate region.
6. 3.
   In the left-hand menu, click on "Logs" and select the log group where you want to create a filter.
8. 4.
   Click on "Create Metric Filter" to begin the configuration.
10. 5.
    In the "Filter Pattern" section, specify the filter pattern that matches IAM policy change events. For example, you can use the following filter pattern:

{ ($.eventName = CreatePolicyVersion) || ($.eventName = DeletePolicy) || ($.eventName = DeletePolicyVersion) || ($.eventName = PutGroupPolicy) || ($.eventName = PutRolePolicy) || ($.eventName = PutUserPolicy) || ($.eventName = RemoveGroupPolicy) || ($.eventName = RemoveRolePolicy) || ($.eventName = RemoveUserPolicy) || ($.eventName = SetDefaultPolicyVersion) || ($.eventName = UpdateAssumeRolePolicy) || ($.eventName = UpdatePolicy) || ($.eventName = UpdateRolePolicy) }

2. 1.
   Choose a name for your metric filter and provide a metric namespace, metric name, and metric value.
4. 2.
   Click on "Create Filter" to save the configuration.

Step 2: Configure Alarm

2. 1.
   In the CloudWatch Management Console, navigate to the "Alarms" section.
4. 2.
   Click on "Create Alarm" to start setting up the alarm.
6. 3.
   In the "Select metric" section, search and select the metric that corresponds to the IAM policy change filter created in Step 1.
8. 4.
   Set the conditions for the alarm. For example, you can set the threshold to "1" and select the period and evaluation periods as per your requirements.
10. 5.
    Configure the actions that should be triggered when the alarm state is triggered, such as sending a notification via SNS or triggering an AWS Lambda function.
12. 6.
    Review the settings and click on "Create Alarm" to save the configuration.

Step 3: Verify and Test

2. 1.
   To verify that the log metric filter and alarm are functioning correctly, make a test change to an IAM policy within your AWS environment.
4. 2.
   Check if the CloudWatch logs capture the change event.
6. 3.
   Verify if the CloudWatch alarm is triggered and notifications are received as expected.
8. 4.
   Ensure that the IAM policy change is reflected in your NIST CSF v1 compliance guidelines.