# 4.9 Ensure AWS Config Configuration Changes are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233136-4-9-ensure-aws-config-configuration-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 2** ## **Description:** AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. Monitoring AWS Config changes ensures that AWS Config remains active and properly configured. AWS Config is a service that enables continuous monitoring of AWS resource configurations. Any unauthorized or accidental modifications to AWS Config can result in: - Loss of configuration history for compliance and security auditing. - Disruption in change tracking across AWS resources. - Security risks due to disabled configuration monitoring. This control ensures that AWS Config configuration modifications (e.g., stopping, deleting, or modifying configuration recorders or delivery channels) are logged, monitored, and alerted using CloudWatch Alarms and Amazon SNS notifications. ## Rationale: Monitoring AWS Config changes helps detect: - Unauthorized modifications that disable AWS Config tracking. - Accidental misconfigurations that disrupt AWS resource compliance monitoring. - Security incidents involving unexpected configuration setting changes. ## Impact: - Failure to monitor AWS Config changes can result in: - Lack of visibility into AWS resource configurations. - Failure to comply with security and compliance policies. - Inability to track changes for troubleshooting security incidents. - Enabling monitoring does not impact performance, but it requires AWS CloudTrail and CloudWatch costs. ## Default Value: - AWS CloudTrail does not log AWS Config changes by default. - CloudWatch Alarms and SNS notifications must be manually configured to monitor AWS Config modifications. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home)![](https://support.icompaas.com/assets/kb/212707feae8b2ebf.png). 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/adb8466a94442c05.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/db6973600a0df6f5.png) 5. Check that CloudTrail logs are being sent to CloudWatch. 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). ![](https://support.icompaas.com/assets/kb/dd317bd29f0564d0.png) 7. Ensure that a metric filter is created for AWS Config changes. ![](https://support.icompaas.com/assets/kb/3bd2bf9b8dd0bdbf.png) 8. Check CloudWatch Alarms for alerts on AWS Config modifications. ![](https://support.icompaas.com/assets/kb/6d6d60a268a58422.png) ## Implementation Steps: Using AWS CLI ### Step 1: Create a Metric Filter for AWS Config Changes aws logs put-metric-filter --log-group-name \\ --filter-name aws-config-changes-metric \\ --metric-transformations metricName=aws-config-changes-metric,metricNamespace="CISBenchmark",metricValue=1 \\ --filter-pattern '{ ($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder)) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name aws-config-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for AWS Config Changes aws cloudwatch put-metric-alarm --alarm-name aws-config-changes-alarm \\ --metric-name aws-config-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace "CISBenchmark" --alarm-actions ## Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names aws-config-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name aws-config-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [AWS Config Documentation](https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.3

Enable detailed logging for security monitoring.

CIS v7

1.4

Maintain a detailed asset inventory of AWS resources.

CIS v7

11.2

Document traffic configuration rules.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.