# 4.14 Ensure VPC changes are monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000234268-4-14-ensure-vpc-changes-are-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Web Services Foundations Benchmark v5.0.0](https://support.icompaas.com/support/solutions/62000112684) › [CIS AWS Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169233) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability - **Level 1** #### Description AWS VPC (Virtual Private Cloud) allows users to define and control the network environment in which their AWS resources reside. Monitoring VPC changes is critical to maintain the security, integrity, and compliance of the AWS environment. Changes to a VPC, such as the creation of subnets, route tables, or internet gateways, can significantly affect network security and access controls. To ensure visibility and accountability, it is important to monitor any changes to VPC configurations. This can be achieved through AWS CloudTrail, which provides logs of all actions taken within the AWS environment, including VPC modifications. Enabling monitoring ensures that all changes to VPC configurations are tracked, reviewed, and audited. #### Rationale: Monitoring VPC changes provides the following benefits: - Security: Identifies unauthorized or unintended changes that may expose the VPC or other AWS resources to risk. - Compliance: Helps meet regulatory and security standards that require continuous monitoring and auditing of VPC changes. - Auditability: Provides a full audit trail of all VPC-related changes, which is critical for forensic investigations and troubleshooting. - Change management: Ensures that all modifications to VPC configurations are intentional and documented, helping to avoid configuration drift or misconfigurations. Without monitoring, unauthorized changes to VPC configurations could go undetected, potentially introducing security risks or compliance violations. #### Impact: Failure to monitor VPC changes can result in: - Unauthorized changes: Configuration changes made by unauthorized users may not be detected, leading to security vulnerabilities. - Non-compliance: Without monitoring, you may violate compliance standards that mandate continuous tracking and auditing of infrastructure changes. - Network misconfigurations: Changes that are not tracked may lead to misconfigurations, causing network outages or security weaknesses. Enabling monitoring of VPC changes ensures that all modifications are intentional, secure, and auditable. #### Default Value: By default, AWS does not automatically monitor or log all VPC changes unless CloudTrail is configured to do so. You need to enable CloudTrail and configure it to monitor VPC-related events. #### Pre-Requisites: - AWS CLI installed and configured - IAM permissions: - cloudtrail:CreateTrail - cloudtrail:DescribeTrails - cloudtrail:PutEventSelectors - cloudtrail:StartLogging - CloudTrail must be configured to log VPC-related events #### Remediation: ##### Test Plan: Using AWS Console: 1. Go to the [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). 2. Check if CloudTrail is set up and verify that VPC-related events are being logged. 3. Ensure that VPC-related activities (such as creating VPCs, subnets, route tables, etc.) are being captured in the CloudTrail logs. 4. Verify that CloudTrail is enabled for all regions where VPC changes need to be monitored. Using AWS CLI: aws cloudtrail describe-trails --query "trailList\[?Name==''\]" --output table To verify the event selectors for VPC-related activities: aws cloudtrail get-event-selectors --trail-name --output table ##### Implementation Plan: Using AWS Console: 1. Enable CloudTrail for VPC change monitoring: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Create a new trail or modify an existing trail to ensure that management events are captured. - Under Event selectors, ensure that Read and Write management events are enabled to capture all changes to VPC configurations. - Make sure that global services events are enabled to log VPC changes across all regions. 2. Verify CloudTrail logging for VPC changes: - After enabling the trail, check the Event history in CloudTrail for logged VPC-related events, such as CreateVpc, CreateSubnet, and ModifyVpcAttribute. Using AWS CLI: 1. Enable CloudTrail to monitor VPC changes: aws cloudtrail create-trail --name --s3-bucket-name --include-global-service-events 2. Verify the event selectors for CloudTrail: aws cloudtrail get-event-selectors --trail-name --output table 3. Check for VPC-related events in CloudTrail: aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=vpc.amazonaws.com --output table #### Backout Plan: Using AWS Console: 1. If enabling CloudTrail causes issues with performance or logging: - Go to the [CloudTrail Console](https://console.aws.amazon.com/cloudtrail/). - Disable or modify the trail to reduce the volume of logged events, if necessary. 2. Review the CloudTrail configuration to ensure it is not over-logging or collecting unnecessary events that could affect performance. Using AWS CLI: 1. Disable CloudTrail logging temporarily: aws cloudtrail stop-logging --name 2. Re-enable CloudTrail logging: aws cloudtrail start-logging --name #### References: - [AWS CloudTrail Documentation ](https://docs.aws.amazon.com/cloudtrail/latest/userguide/) - [AWS CLI Command Reference for CloudTrail ](https://docs.aws.amazon.com/cli/latest/reference/cloudtrail/) - [AWS Best Practices for CloudTrail ](https://aws.amazon.com/cloudtrail/) #### CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

4.9

Perform Continuous Security Monitoring and Incident Detection

CIS v7

6.3

Monitor Security Configurations for Compliance

CIS v7

5.2

Securely Manage and Monitor Cloud Accounts and Services

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.