Description

Ensure that AWS CloudTrail events are sent to Amazon CloudWatch Logs and that the trail's log group has a metric filter and CloudWatch alarm for VPC changes. The filter must include all of CreateVpc, DeleteVpc, ModifyVpcAttribute, AcceptVpcPeeringConnection, CreateVpcPeeringConnection, DeleteVpcPeeringConnection, RejectVpcPeeringConnection, AttachClassicLinkVpc, DetachClassicLinkVpc, DisableVpcClassicLink and EnableVpcClassicLink.

Rationale

A VPC holds the network that workloads run in, and VPC peering connects it to other networks. Without monitoring, an unauthorized or accidental VPC change can connect private networks to untrusted ones, allow data exfiltration or lateral movement, or cause outages, and go unnoticed. An alarm on these events lets the security team review every VPC change quickly. VPC changes should also be limited to authorized administrators and require change approval.

Impact

  • Provides near real-time alerts when VPCs or VPC peering connections are created, changed or deleted

  • The ClassicLink events are kept in the pattern for completeness; EC2-Classic has been retired, so they are not expected to occur

  • No effect on running workloads; the filter and alarm only read CloudTrail events

  • Adds a small cost for the CloudWatch alarm, and for CloudWatch Logs ingestion if CloudTrail was not already sending events to CloudWatch Logs

Default Value

No metric filters or CloudWatch alarms exist by default. A CloudTrail trail does not send events to CloudWatch Logs unless this is configured on the trail.

Pre-Requisites

  • IAM permissions: cloudtrail:DescribeTrails, cloudtrail:UpdateTrail, logs:DescribeMetricFilters, logs:PutMetricFilter, cloudwatch:DescribeAlarmsForMetric, cloudwatch:PutMetricAlarm, plus logs:DeleteMetricFilter and cloudwatch:DeleteAlarms for the backout plan

  • A CloudTrail trail, preferably multi-region, that sends its events to a CloudWatch Logs log group

  • An Amazon SNS topic with confirmed subscribers (for example, the security team's email address) to receive the alarm notifications

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the AWS CloudTrail console and select Trails.

  3. Open each trail and, in the CloudWatch Logs section, note the log group the trail sends events to.

  4. Open the Amazon CloudWatch console in the region of that log group, choose Log groups and select the log group.

  5. Open the Metric filters tab and check for a filter whose pattern includes all of these events: CreateVpc, DeleteVpc, ModifyVpcAttribute, AcceptVpcPeeringConnection, CreateVpcPeeringConnection, DeleteVpcPeeringConnection, RejectVpcPeeringConnection, AttachClassicLinkVpc, DetachClassicLinkVpc, DisableVpcClassicLink and EnableVpcClassicLink.

  6. Note the metric name of that filter, then choose Alarms, All alarms and check that an alarm exists for that metric.

  7. If no trail's log group has such a metric filter with an alarm, follow the implementation steps.

CLI:

List the trails and the CloudWatch Logs log group each one sends events to:

aws cloudtrail describe-trails --region <REGION> --query "trailList[].[Name,HomeRegion,IsMultiRegionTrail,CloudWatchLogsLogGroupArn]" --output table

List the metric filters of the log group (the name after log-group: in the ARN), in the region of the log group:

aws logs describe-metric-filters --region <REGION> --log-group-name <LOG_GROUP_NAME> --query "metricFilters[].[filterName,filterPattern,metricTransformations[0].metricName,metricTransformations[0].metricNamespace]" --output table

List the alarms on the metric of the matching filter:

aws cloudwatch describe-alarms-for-metric --region <REGION> --metric-name <METRIC_NAME> --namespace <METRIC_NAMESPACE> --query "MetricAlarms[].[AlarmName,StateValue,ActionsEnabled]" --output table

The account fails if no trail sends events to a log group, if no metric filter on a trail's log group has a pattern that includes every event listed above, or if no alarm exists for the metric of that filter.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. If no trail sends events to CloudWatch Logs, open the AWS CloudTrail console, open a multi-region trail, choose Edit in the CloudWatch Logs section, enable it, select or create a log group and an IAM role, and save the changes.

  3. Open the Amazon CloudWatch console in the region of the trail's log group, choose Log groups and select the log group.

  4. Open the Metric filters tab and choose Create metric filter.

  5. In Filter pattern, enter { ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) } and choose Next.

  6. Enter the metric details and choose Next:

    • Filter name: vpc_changes

    • Metric namespace: CISBenchmark

    • Metric name: vpc_changes_metric

    • Metric value: 1

  7. Choose Create metric filter.

  8. On the Metric filters tab, select the new filter and choose Create alarm.

  9. Set the metric and conditions, then choose Next:

    • Statistic: Sum

    • Period: 5 minutes

    • Threshold type: Static, Greater/Equal, 1

  10. Under Notification, select the SNS topic that alerts the security team and choose Next.

  11. Enter the alarm name vpc_changes_alarm, choose Next, then Create alarm.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon CloudWatch console, choose Alarms, All alarms, select the vpc_changes_alarm alarm and delete it.

  3. Choose Log groups, select the trail's log group, open the Metric filters tab, select the vpc_changes filter and delete it.

CLI:

aws cloudwatch delete-alarms --region <REGION> --alarm-names vpc_changes_alarm
aws logs delete-metric-filter --region <REGION> --log-group-name <LOG_GROUP_NAME> --filter-name vpc_changes

Note: removing the metric filter and alarm stops alerts for changes to VPCs, so these events can again go unnoticed.

Reference