# Ensure a log metric filter and alarm exist for AWS Organizations changes - Source: https://support.icompaas.com/support/solutions/articles/62000228348-ensure-a-log-metric-filter-and-alarm-exist-for-aws-organizations-changes - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## **Description:** AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. Amazon CloudWatch monitors your Amazon Web Services (AWS) resources and the applications you run on AWS in real time. You can use CloudWatch to collect and track metrics, which are variables you can measure for your resources and applications. Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. ## **Rationale:** Monitoring AWS Organizations changes can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches.  ## **Impact:** Ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back. ## **Default value:** CloudTrail trails and cloud watch don't log data events and alarms by default. ## **Pre-Requisite:** AWS Organization, CloudTrail, Cloud Watch and SNS. ## **Remediation:** **Test Plan:** - **AWS Console Process** 1. Login to AWS console of organizations account and go to Cloud Trail and click on trails in the left pane.![](https://support.icompaas.com/assets/kb/208eaafb51639f56.png) 2. Click on a trail you want to see details.  ![](https://support.icompaas.com/assets/kb/caee504df961f941.png)   3. Identify Multi region Cloudtrails, Trails with "IsMultiRegionTrail" set to true. 4. **Note**: if not follow Implementation plan. 5. Under the CloudWatch logs section check if there any log group mentioned 6. Open the CloudWatch console. 7. Go to CloudWatch and check the left side panel for Settings. Click on Setting 8. On the Cloudwatch setting dashboard, you can see list of CloudWatch alarms and filter on the organizations\_changes. 9. **Note**: if not follow Implementation plan. 10. Now need to check sns, go to the sns dashboard 11. Click on Topic in the left pane 12. And check at least one subscription should have "Subscription Arn" with valid aws ARN for organization. **Using AWS CLI** 1. Perform the following to ensure that there is at least one active multi-region CloudTrail with prescribed metric filters and alarms configured: - Identify the log group name configured for use with active multi-region CloudTrail:  - List all CloudTrails: aws cloudtrail describe-trails - Identify Multi region Cloudtrails, Trails with "IsMultiRegionTrail" set to true - From value associated with CloudWatchLogsLogGroupArn note. - Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:::log-group:NewGroup:\*, cloudtrail\_log\_group\_name> would be NewGroup - Ensure Identified Multi region CloudTrail is active: - aws cloudtrail get-trail-status --name Ensure IsLogging is set to TRUE  - Ensure identified Multi-region Cloudtrail captures all Management Events: aws cloudtrail get-event-selectors --trail-name - Ensure there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All.   2. Get a list of all associated metric filters for this : aws logs describe-metric-filters --log-group-name ""   3. Ensure the output from the above command contains the following: "filterPattern": "{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }"   4. Note the value associated with the filterPattern   5. Get a list of CloudWatch alarms and filter on the aws cloudwatch describe-alarms --query 'MetricAlarms\[?MetricName== \]'   6. Note the AlarmActions value - this will provide the SNS topic ARN value.    7. Ensure there is at least one active subscriber to the SNS topic by below command aws sns list-subscriptions-by-topic --topic-arn at least one subscription should have "SubscriptionArn" with valid aws ARN. Example of valid "SubscriptionArn"  "arn:aws:sns::::" ### **Implementation Plan**: - **AWS Console Process** 1. Log in to the AWS Management Console and go to Cloudwatch dashboard at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/") 2. In the left navigation, pane click on Log groups under Logs ![](https://support.icompaas.com/assets/kb/29ee182e593a0852.png)  3. Select the log group for which you want to create a metric filter  4. Click on the Actions drop-down menu, select create a metric filter ![](https://support.icompaas.com/assets/kb/fb618150cf027b26.png)  5. In the Create metric filter page, we define the filter pattern as '{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }' ![](https://support.icompaas.com/assets/kb/06ae55205f84a755.png)  6. On Assign metric page, under the Create filter name give the filter name as RouteTable\_changes![](https://support.icompaas.com/assets/kb/e9617c9ed571bd3c.png) 7. Under the Metric Details section, provide the details required like Metric namespace, Metric name, metric value, and Default value(optional), and then click on the Next button  ![](https://support.icompaas.com/assets/kb/dede5786df4e3139.png)   8. Review the details provided and click on Create metric filter button to create it 9. After clicking on create metric filter You will see a metric filters page, Select the metric filter you have created and click on create an alarm on the right side of the Metric filters section. ![](https://support.icompaas.com/assets/kb/28aa9b75da16bd55.png)  10. After clicking on create alarm you will be redirected to the next tab to Create Alarm, define the following:- - Metric name (it automatically takes from the metric filter) - Statistic select Sum - Period as required.![](https://support.icompaas.com/assets/kb/1823fbc9e53c1299.png) 11. In the conditions section select the Threshold type to Static, Define the alarm condition with a Greater(>) threshold and give the value of threshold as you defined in metric value then click on the Next button  ![](https://support.icompaas.com/assets/kb/94c5bfbd6dbbd253.png)   12. Next is Configure actions in this choose Alarm state trigger option as In alarm, For SNS topic select SNS if exist or can create a new topic, click on NEXT ![](https://support.icompaas.com/assets/kb/6f321fb7c8e4e16c.png)  13. Give the Name of Alarm, click on the Next button. 14. Review all the entered details and click on create Alarm **Using AWS CLI** Perform the following to setup the metric filter, alarm, SNS topic, and subscription: - Identify the log group name configured for use with active multi-region CloudTrail:  - List all CloudTrails: aws cloudtrail describe-trails - Identify Multi region Cloudtrails, Trails with "IsMultiRegionTrail" set to true - From value associated with CloudWatchLogsLogGroupArn note. - Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:::log-group:NewGroup:\*, cloudtrail\_log\_group\_name> would be NewGroup - Ensure Identified Multi region CloudTrail is active: - Create a metric filter based on filter pattern provided which checks for AWS Organizations changes and the aws logs put-metric-filter --log-group-name --filter-name \`\` --metric-transformations metricName=\`\`,metricNamespace='CISBenchmark',metricValue=1 --filter-pattern '{ ($.eventSource = organizations.amazonaws.com) && (($.eventName = "AcceptHandshake") || ($.eventName = "AttachPolicy") || ($.eventName = "CreateAccount") || ($.eventName = "CreateOrganizationalUnit") || ($.eventName = "CreatePolicy") || ($.eventName = "DeclineHandshake") || ($.eventName = "DeleteOrganization") || ($.eventName = "DeleteOrganizationalUnit") || ($.eventName = "DeletePolicy") || ($.eventName = "DetachPolicy") || ($.eventName = "DisablePolicyType") || ($.eventName = "EnablePolicyType") || ($.eventName = "InviteAccountToOrganization") || ($.eventName = "LeaveOrganization") || ($.eventName = "MoveAccount") || ($.eventName = "RemoveAccountFromOrganization") || ($.eventName = "UpdatePolicy") || ($.eventName = "UpdateOrganizationalUnit")) }' Note: You can choose your own metricName and metricNamespace strings. Using the same metricNamespace for all Foundations Benchmark metrics will group them together.  -  Create an SNS topic that the alarm will notify: aws sns create-topic --name Note: you can execute this command once and then re-use the same topic for all monitoring alarms. - Create an SNS subscription to the topic created aws sns subscribe --topic-arn \--protocol \--notification-endpoint - Create an alarm that is associated with the CloudWatch Logs Metric Filter created and an SNS topic created  aws cloudwatch put-metric-alarm \--alarm-name \`\` \--metric-name \`\` \--statistic Sum \--period 300 \--threshold 1 \--comparison-operator GreaterThanOrEqualToThreshold \--evaluationperiods 1 \--namespace 'CISBenchmark' \--alarm-actions ### **Backout Plan:** - **AWS Console Process** 1. Sign in to the AWS Management Console and open the CloudTrail console at [https://console.aws.amazon.com/cloudtrail/](https://console.aws.amazon.com/cloudtrail/ "https://console.aws.amazon.com/cloudtrail/"). 2. Open the **Trails** page of the CloudTrail console. 3. Choose the desired trail name. 4. At the top of the trail details page, choose **Delete**. 5. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/ "https://console.aws.amazon.com/cloudwatch/"). 6. In the navigation pane, choose **Alarms**. 7. Select the check box of desired alarm to the left of the name of the alarm, and choose **Actions**, **Delete**. 8. Choose **Delete**. 9. Sign in to the [Amazon SNS console](https://console.aws.amazon.com/sns/home "https://console.aws.amazon.com/sns/home"). 10. In the left navigation pane, choose desired **Subscriptions**. 11. On the **Subscriptions** page, select a subscription with a **Status** of **Confirmed**, and then choose **Delete**. 12. In the **Delete subscription** dialog box, choose **Delete**. **Using AWS CLI** - List all CloudTrails: aws cloudtrail describe-trails - Identify Multi region Cloudtrails, Trails with "IsMultiRegionTrail" set to true - From value associated with CloudWatchLogsLogGroupArn note. - Example: for CloudWatchLogsLogGroupArn that looks like arn:aws:logs:::log-group:NewGroup:\*, cloudtrail\_log\_group\_name> would be NewGroup - Delete the trail created. aws cloudtrail delete-trail --name arn:aws:logs:::log-group:NewGroup - Delete sns topic created aws sns delete-topic \--topic-arn - Delete the created alarm aws cloudwatch delete-alarms \--alarm-name \`\` ### **References:** [Logging and monitoring in AWS Organizations - AWS Organizations (amazon.com)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html "https://docs.aws.amazon.com/organizations/latest/userguide/orgs_security_incident-response.html") ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.