# 4.11 Ensure Network Access Control List (NACL) Changes are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233134-4-11-ensure-network-access-control-list-nacl-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 2** ## **Description:** AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. Monitoring NACL changes ensures that network security rules remain consistent and secure. Network Access Control Lists (NACLs) act as stateless packet filters controlling ingress and egress traffic for subnets within a VPC. Any unauthorized or accidental modifications can result in: - Unauthorized access to AWS resources. - Network misconfigurations leading to downtime. - Security risks due to unintended exposure of sensitive resources. This control ensures that NACL modifications (e.g., creation, deletion, entry modifications, and association changes) are logged, monitored, and alerted using CloudWatch Alarms and Amazon SNS notifications. Rationale: Monitoring NACL changes helps detect: - Unauthorized modifications that may allow malicious traffic. - Accidental misconfigurations that disrupt access controls. - Security incidents involving unexpected traffic flow changes. ## Impact: - Failure to monitor NACL changes can result in: - Exposing AWS resources to unauthorized traffic. - Loss of access control for critical applications. - Security risks due to open access to untrusted networks. - Enabling monitoring does not impact performance, but it requires AWS CloudTrail and CloudWatch costs. ## Default Value: - AWS CloudTrail does not log NACL changes by default. - CloudWatch Alarms and SNS notifications must be manually configured to monitor NACL modifications. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/d905d49019cf39f8.png) 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/45069ede5afaf17d.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/05f66823b78c520f.png) 5. Check that CloudTrail logs are being sent to CloudWatch. ![](https://support.icompaas.com/assets/kb/29b64ee2895379f3.png) 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). 7. Ensure that a metric filter is created for NACL changes. 8. Check CloudWatch Alarms for alerts on NACL modifications. ![](https://support.icompaas.com/assets/kb/8c9fcb6908b9c8b7.png) Implementation Steps: Using AWS CLI Step 1: Create a Metric Filter for NACL Changes aws logs put-metric-filter --log-group-name \\ --filter-name nacl-changes-metric \\ --metric-transformations metricName=nacl-changes-metric,metricNamespace='CISBenchmark',metricValue=1 \\ --filter-pattern '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name nacl-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for NACL Changes aws cloudwatch put-metric-alarm --alarm-name nacl-changes-alarm \\ --metric-name nacl-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names nacl-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name nacl-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [AWS Network ACL Documentation ](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.3

Enable detailed logging for security monitoring.

CIS v7

11.3

Use automated tools to verify standard configurations and detect changes.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.