Rule: Ensure a log metric filter and alarm exist for VPC changes

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify if the CloudTrail service is enabled in the AWS Management Console.
4. 2.
   Ensure that the necessary IAM permissions are granted to access and configure CloudTrail and CloudWatch services.
6. 3.
   Confirm that the necessary log groups and metric filters are created correctly.
8. 4.
   Check if the alarm is set up properly and associated with the metric filter.
10. 5.
    Validate that the alert notifications are correctly configured.

Necessary Codes:

Step-by-step Guide for Remediation:

CloudTrail Setup:

2. 1.
   Go to the AWS Management Console and navigate to the CloudTrail service.
4. 2.
   Click on "Create trail" to create a new trail.
6. 3.
   Provide a name for the trail and select a S3 bucket to store the CloudTrail logs.
8. 4.
   Enable "Management events" for the trail.
10. 5.
    Under "Data events", enable logging for "CreateVpc", "DeleteVpc", and "ModifyVpcAttribute" events.
12. 6.
    Click on "Create" to create the trail.

CloudWatch Metric Filter Setup:

2. 1.
   Go to the AWS Management Console and navigate to the CloudWatch service.
4. 2.
   Click on "Log groups" and select the log group corresponding to the CloudTrail logs.
6. 3.
   Click on "Create metric filter" for the log group.
8. 4.
   Specify a filter pattern that captures VPC-related events. Example:

   { $.eventName = "CreateVpc" || $.eventName = "DeleteVpc" || $.eventName = "ModifyVpcAttribute" }

10. 5.
    Choose a metric namespace and name for the filter.
12. 6.
    Click on "Create filter" to create the metric filter.

CloudWatch Alarm Setup:

2. 1.
   In the CloudWatch Management Console, go to "Alarms" on the left-hand menu.
4. 2.
   Click on "Create alarm" to configure a new alarm.
6. 3.
   Select the metric filter created in the previous step as the alarm source.
8. 4.
   Set the appropriate threshold and conditions for the alarm trigger. You can choose to trigger the alarm when the count is greater than zero or set a specific threshold.
10. 5.
    Configure the actions to be taken when the alarm is triggered, such as sending a notification via SNS topic or executing an Auto Scaling policy.
12. 6.
    Click on "Create alarm" to create the alarm.

Conclusion: