# 4.12 Ensure Changes to Network Gateways are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233126-4-12-ensure-changes-to-network-gateways-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 1:** ## **Description:** AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. Monitoring network gateway changes ensures that all ingress/egress traffic is routed securely and controlled. Network gateways such as Internet Gateways (IGW), Customer Gateways (CGW), and Virtual Private Gateways (VGW) provide connectivity between AWS VPCs and external networks. Any unauthorized or accidental modifications can result in: - Unintended exposure of AWS resources to the internet. - Loss of connectivity to on-premises networks. - Security risks due to unauthorized route modifications. This control ensures that network gateway modifications (e.g., creation, deletion, attachment, detachment) are logged, monitored, and alerted using CloudWatch Alarms and Amazon SNS notifications. ## Rationale: Monitoring network gateway changes helps detect: - Unauthorized modifications that may allow malicious ingress/egress traffic. - Misconfigurations that disrupt connectivity between AWS and external networks. - Potential security incidents involving unauthorized gateway attachments. ## Impact: - Failure to monitor network gateway changes can result in: - Unintended exposure of AWS resources to public networks. - Loss of connectivity between AWS and on-premises networks. - Security risks due to unauthorized internet or VPN gateway modifications. - Enabling monitoring does not impact performance, but it requires AWS CloudTrail and CloudWatch costs. ## Default Value: - AWS CloudTrail does not log network gateway changes by default. - CloudWatch Alarms and SNS notifications must be manually configured to monitor network gateway modifications. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/d6b7428d7464afde.png) 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/67db73093b5dafc8.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/0781bea9619a65a2.png) 5. Check that CloudTrail logs are being sent to CloudWatch. ![](https://support.icompaas.com/assets/kb/c0c0a809f2a2df6b.png) 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). 7. Ensure that a metric filter is created for network gateway changes. 8. Check CloudWatch Alarms for alerts on network gateway modifications. ![](https://support.icompaas.com/assets/kb/d0fc5f678c9bd9f0.png) ## Implementation Steps: Using AWS Console Step 1: Create a Metric Filter for Network Gateway Changes aws logs put-metric-filter --log-group-name \\ --filter-name network-gw-changes-metric \\ --metric-transformations metricName=network-gw-changes-metric,metricNamespace='CISBenchmark',metricValue=1 \\ --filter-pattern '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name network-gw-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for Network Gateway Changes aws cloudwatch put-metric-alarm --alarm-name network-gw-changes-alarm \\ --metric-name network-gw-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names network-gw-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name network-gw-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [AWS Network Gateway Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.2

Activate audit logging on all systems.

CIS v7

6.3

Enable detailed logging for security monitoring.

CIS v7

11.3

Use automated tools to verify standard configurations and detect changes.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.