# 4.13 Ensure Route Table Changes are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233125-4-13-ensure-route-table-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: **Level 1** ## Description: AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. Monitoring route table changes is crucial to ensure that network traffic flows securely and as expected. Route tables determine how network traffic is routed within a VPC, and any unauthorized or accidental modifications could lead to: - Unintended exposure to the internet. - Network misconfigurations causing downtime. - Security risks due to unauthorized route modifications. This control ensures that route table modifications (e.g., creation, replacement, deletion, disassociation) are logged, monitored, and alerted using CloudWatch Alarms and Amazon SNS notifications. ## Rationale: Monitoring route table changes helps detect: - Unauthorized modifications that may redirect traffic. - Misconfigurations that break connectivity. - Potential security incidents involving rogue routes or backdoors. ## Impact: - Failure to monitor route table changes can result in: - Unauthorized traffic redirection leading to data exfiltration. - Loss of connectivity for critical applications. - Security risks due to open access to untrusted networks. - Enabling monitoring does not impact performance, but it requires AWS CloudTrail and CloudWatch costs. ## Default Value: - AWS CloudTrail does not log route table changes by default. - CloudWatch Alarms and SNS notifications must be manually configured to monitor route table modifications. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/1107cbe3f35e1330.png) 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/613ea8f7129297e8.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/ffb6e441fbcf01f8.png) 5. Check that CloudTrail logs are being sent to CloudWatch. ![](https://support.icompaas.com/assets/kb/d3ab037588cfbc96.png) 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). 7. Ensure that a metric filter is created for route table changes. 8. Check CloudWatch Alarms for alerts on route table modifications.    ![](https://support.icompaas.com/assets/kb/580c53cc9a669183.png)     Implementation Steps: Using AWS Console Step 1: Create a Metric Filter for Route Table Changes aws logs put-metric-filter --log-group-name \\ --filter-name route-table-changes-metric \\ --metric-transformations metricName=route-table-changes-metric,metricNamespace='CISBenchmark',metricValue=1 \\ --filter-pattern '{ ($.eventSource = ec2.amazonaws.com) && ($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name route-table-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for Route Table Changes aws cloudwatch put-metric-alarm --alarm-name route-table-changes-alarm \\ --metric-name route-table-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names route-table-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name route-table-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [AWS VPC Security Best Practices ](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-best-practices.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.2

Activate audit logging on all systems.

CIS v7

6.3

Enable detailed logging for security monitoring.

CIS v7

11.3

Use automated tools to verify standard configurations and detect changes.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.