# Ensure a log metric filter and alarm exist for route table changes - Source: https://support.icompaas.com/support/solutions/articles/a_1793292194239929-ensure-a-log-metric-filter-and-alarm-exist-for-route-table-changes - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that AWS CloudTrail events are sent to Amazon CloudWatch Logs and that the trail's log group has a metric filter and CloudWatch alarm for VPC route table changes. The filter pattern must include $.eventSource = ec2.amazonaws.com together with CreateRoute, CreateRouteTable, ReplaceRoute, ReplaceRouteTableAssociation, DeleteRoute, DeleteRouteTable and DisassociateRouteTable; a filter without the event source clause does not satisfy the requirement. **Rationale** Route tables decide where traffic between subnets, gateways and peered networks is sent. Without monitoring, an unauthorized or accidental route change can redirect traffic around inspection points, send data to an attacker-controlled destination, or cause outages, and go unnoticed. An alarm on these events lets the security team review every routing change quickly. Route changes should also be limited to authorized administrators and made through change control. **Impact** - Provides near real-time alerts when routes or route tables are created, replaced, deleted or re-associated - No effect on running workloads; the filter and alarm only read CloudTrail events - Adds a small cost for the CloudWatch alarm, and for CloudWatch Logs ingestion if CloudTrail was not already sending events to CloudWatch Logs **Default Value** No metric filters or CloudWatch alarms exist by default. A CloudTrail trail does not send events to CloudWatch Logs unless this is configured on the trail. **Pre-Requisites** - IAM permissions: cloudtrail:DescribeTrails, cloudtrail:UpdateTrail, logs:DescribeMetricFilters, logs:PutMetricFilter, cloudwatch:DescribeAlarmsForMetric, cloudwatch:PutMetricAlarm, plus logs:DeleteMetricFilter and cloudwatch:DeleteAlarms for the backout plan - A CloudTrail trail, preferably multi-region, that sends its events to a CloudWatch Logs log group - An Amazon SNS topic with confirmed subscribers (for example, the security team's email address) to receive the alarm notifications **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS CloudTrail console and select **Trails**. 3. Open each trail and, in the **CloudWatch Logs** section, note the log group the trail sends events to. 4. Open the Amazon CloudWatch console in the region of that log group, choose **Log groups** and select the log group. 5. Open the **Metric filters** tab and check for a filter whose pattern includes the event source ec2.amazonaws.com and all of these events: CreateRoute, CreateRouteTable, ReplaceRoute, ReplaceRouteTableAssociation, DeleteRouteTable, DeleteRoute and DisassociateRouteTable. 6. Note the metric name of that filter, then choose **Alarms**, **All alarms** and check that an alarm exists for that metric. 7. If no trail's log group has such a metric filter with an alarm, follow the implementation steps. **CLI:** List the trails and the CloudWatch Logs log group each one sends events to: aws cloudtrail describe-trails --region --query "trailList\[\].\[Name,HomeRegion,IsMultiRegionTrail,CloudWatchLogsLogGroupArn\]" --output table List the metric filters of the log group (the name after log-group: in the ARN), in the region of the log group: aws logs describe-metric-filters --region --log-group-name --query "metricFilters\[\].\[filterName,filterPattern,metricTransformations\[0\].metricName,metricTransformations\[0\].metricNamespace\]" --output table List the alarms on the metric of the matching filter: aws cloudwatch describe-alarms-for-metric --region --metric-name --namespace --query "MetricAlarms\[\].\[AlarmName,StateValue,ActionsEnabled\]" --output table The account fails if no trail sends events to a log group, if no metric filter on a trail's log group has a pattern that includes $.eventSource = ec2.amazonaws.com and every event listed above, or if no alarm exists for the metric of that filter. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. If no trail sends events to CloudWatch Logs, open the AWS CloudTrail console, open a multi-region trail, choose **Edit** in the **CloudWatch Logs** section, enable it, select or create a log group and an IAM role, and save the changes. 3. Open the Amazon CloudWatch console in the region of the trail's log group, choose **Log groups** and select the log group. 4. Open the **Metric filters** tab and choose **Create metric filter**. 5. In **Filter pattern**, enter {($.eventSource = ec2.amazonaws.com) && (($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable))} and choose **Next**. 6. Enter the metric details and choose **Next**: - **Filter name**: route\_table\_changes - **Metric namespace**: CISBenchmark - **Metric name**: route\_table\_changes\_metric - **Metric value**: 1 7. Choose **Create metric filter**. 8. On the **Metric filters** tab, select the new filter and choose **Create alarm**. 9. Set the metric and conditions, then choose **Next**: - **Statistic**: **Sum** - **Period**: **5 minutes** - **Threshold type**: **Static**, **Greater/Equal**, 1 10. Under **Notification**, select the SNS topic that alerts the security team and choose **Next**. 11. Enter the alarm name route\_table\_changes\_alarm, choose **Next**, then **Create alarm**. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon CloudWatch console, choose **Alarms**, **All alarms**, select the route\_table\_changes\_alarm alarm and delete it. 3. Choose **Log groups**, select the trail's log group, open the **Metric filters** tab, select the route\_table\_changes filter and delete it. **CLI:** aws cloudwatch delete-alarms --region --alarm-names route\_table\_changes\_alarm aws logs delete-metric-filter --region --log-group-name --filter-name route\_table\_changes Note: removing the metric filter and alarm stops alerts for changes to VPC route tables, so these events can again go unnoticed. **Reference** - [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Alarm-On-Logs.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Alarm-On-Logs.html) - [https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html](https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.