# 4.4 Ensure IAM Policy Changes Are Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233142-4-4-ensure-iam-policy-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: **Level 1** ## Description: AWS Identity and Access Management (IAM) policies define permissions for users, groups, and roles. Any modification to IAM policies can impact security posture, so continuous monitoring is essential. This control ensures that CloudTrail events related to IAM policy modifications are logged, monitored, and alerted via CloudWatch Alarms and SNS notifications. Events to monitor include: - Policy Creation, Modification, and Deletion - Policy Attachments and Detachments to IAM Roles, Users, or Groups - Changes to Inline and Managed Policies ## Rationale: IAM policies govern who can access what within an AWS environment. Monitoring changes can: - Detect unauthorized modifications that could allow privilege escalation or data breaches. - Ensure compliance with security best practices (SOC 2, HIPAA, PCI DSS). - Identify accidental misconfigurations before they cause security issues. ## Impact: - Real-time detection of unauthorized IAM policy changes. - Possible alert fatigue in large environments with frequent IAM policy updates. - Requires fine-tuning to reduce noise from expected changes. ## Default Value: - AWS does not alert on IAM policy changes by default. - CloudTrail logs IAM policy changes, but organizations must configure CloudWatch Alarms and SNS notifications for proactive monitoring. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. CloudWatch Logs enabled and integrated with CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/661695318e7d38e2.png) 3. Verify there is at least one active multi-region CloudTrail trail. 4. Check that CloudTrail logs are sent to CloudWatch Logs. 5. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). ![](https://support.icompaas.com/assets/kb/c1fe86f6649ee7ff.png) 6. Ensure that a metric filter is created for IAM policy changes. 7. Check CloudWatch Alarms for alerts on IAM policy changes. ![](https://support.icompaas.com/assets/kb/3a19d0eb7b5d3e81.png) Implementation Steps: Using AWS CLI ### Step 1: Create a Metric Filter for IAM Policy Changes aws logs put-metric-filter --log-group-name \\ --filter-name iam-changes-metric \\ --metric-transformations metricName=iam-changes-metric,metricNamespace="CISBenchmark",metricValue=1 \\ --filter-pattern '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name iam-policy-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for IAM Policy Changes aws cloudwatch put-metric-alarm --alarm-name iam-policy-changes-alarm \\ --metric-name iam-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace "CISBenchmark" --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names iam-policy-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name iam-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn **References:** - **[AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html)** - **[AWS IAM Best Practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)** ## **CIS Controls Mapping:**

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.3

Enable detailed logging for security monitoring.

CIS v7

4.9

Log and alert on IAM policy changes.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.