# 4.10 Ensure security group changes are monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000234264-4-10-ensure-security-group-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description: Security groups act as virtual firewalls for instances in AWS, controlling inbound and outbound traffic at the instance level. Monitoring changes to security groups is crucial to ensure that modifications (e.g., rule additions, deletions, or updates) do not inadvertently expose instances or violate security policies. By monitoring security group changes, organizations can quickly detect unauthorized modifications, prevent unintentional exposure, and maintain a secure network configuration. #### Rationale: Security groups play a critical role in controlling traffic between instances and external networks. Unauthorized or accidental changes to security groups can lead to: - Unintended exposure of instances to the public internet - Misconfigured rules that allow unauthorized access - Violations of network segmentation and security policies Monitoring these changes ensures that security group modifications are properly authorized and in line with security best practices. #### Impact: Failure to monitor security group changes can result in: - Uncontrolled access to sensitive resources - Potential data breaches due to misconfigured rules - Increased attack surface from open ports or IP ranges Active monitoring helps to identify and remediate these risks promptly. #### Default Value: By default, AWS does not monitor security group changes. However, these changes can be tracked using AWS CloudTrail and AWS Config. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - ec2:DescribeSecurityGroups - cloudtrail:LookupEvents - config:DescribeConfigurationRecorder - AWS CloudTrail and AWS Config enabled across all AWS regions for tracking changes #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). 2. Verify that Management Events are enabled to log security group changes. 3. Go to the [AWS Config Console](https://console.aws.amazon.com/config/) and confirm that the Configuration Recorder is active and monitoring security group configurations. Using AWS CLI: aws cloudtrail describe-trails --query "trailList\[?Name==''\].{Name:Name, S3BucketName:S3BucketName}" --output table To verify if AWS Config is tracking changes to security groups: aws configservice describe-configuration-recorders --query "ConfigurationRecorders\[?recordingGroup.allSupported==\`true\`\].{Name:name, RecordingGroup:recordingGroup}" --output table ##### Implementation Plan: Using AWS Console: 1. Enable CloudTrail logging for security group changes: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Ensure Management Events are enabled to log security group changes. - Create or update a trail to log events in All Regions. 2. Enable AWS Config to monitor security group configurations: - Go to the [AWS Config Console](https://console.aws.amazon.com/config/). - Enable the Configuration Recorder and ensure that security groups are included in the recording configuration. Using AWS CLI: 1. Verify CloudTrail is logging security group changes: aws cloudtrail describe-trails --query "trailList\[?Name==''\].{Name:Name, S3BucketName:S3BucketName}" --output table 2. Enable AWS Config to track security groups: aws configservice record-configuration-changes --configuration-recorder-name --include-configuration-item-types "AWS::EC2::SecurityGroup" #### Backout Plan: If monitoring security group changes results in excessive logging or performance issues: Using AWS Console: 1. Modify CloudTrail settings to limit event capture or exclude specific event types: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Adjust the Management Events settings to log only critical changes. - You can also turn off logging for specific types of events. 2. Modify AWS Config settings to exclude security groups from configuration recording: - In the [AWS Config Console](https://console.aws.amazon.com/config/), disable security group recording or limit the scope of recorded changes. Using AWS CLI: 1. Limit CloudTrail event capture: aws cloudtrail update-trail --name --no-is-multi-region-trail 2. Stop AWS Config recording for security groups: aws configservice stop-configuration-recorder --configuration-recorder-name Once the performance issue is resolved, you can re-enable security group monitoring. #### References: - [AWS CloudTrail Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) - [AWS Config Documentation](https://docs.aws.amazon.com/config/latest/developerguide/) - [AWS VPC Security Groups Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) #### CIS Controls Mapping:

CIS Control Version	Control ID	Control Description
CIS v8	4.9	Perform Continuous Security Monitoring and Incident Detection
CIS v7	6.3	Monitor Security Configurations for Compliance
CIS v7	5.2	Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.