# Ensure a log metric filter and alarm exist for AWS Management Console authentication failures - Source: https://support.icompaas.com/support/solutions/articles/a_1793292195552992-ensure-a-log-metric-filter-and-alarm-exist-for-aws-management-console-authentication-failures - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that AWS CloudTrail events are sent to Amazon CloudWatch Logs and that the trail's log group has a metric filter with an associated CloudWatch alarm for failed AWS Management Console sign-in attempts. It matches ConsoleLogin events whose error message is Failed authentication. The alarm notifies responders whenever a matching event is recorded. **Rationale** Repeated failed console sign-ins can indicate brute-force or credential-stuffing attempts against IAM users. Without monitoring, these attempts go unnoticed, and a successful guess gives the attacker console access to the account. An alarm on failed sign-ins lets the security team investigate the source IP address and user quickly. MFA and least privilege should also be enforced to limit the impact of a guessed password. **Impact** - Provides near real-time alerts on failed console sign-in attempts - Users who mistype their password also trigger the alarm; raise the threshold if this creates too many alerts - No effect on running workloads; the filter and alarm only read CloudTrail events - Adds a small cost for the CloudWatch alarm, and for CloudWatch Logs ingestion if CloudTrail was not already sending events to CloudWatch Logs **Default Value** No metric filters or CloudWatch alarms exist by default. A CloudTrail trail does not send events to CloudWatch Logs unless this is configured on the trail. **Pre-Requisites** - IAM permissions: cloudtrail:DescribeTrails, cloudtrail:UpdateTrail, logs:DescribeMetricFilters, logs:PutMetricFilter, cloudwatch:DescribeAlarmsForMetric, cloudwatch:PutMetricAlarm, plus logs:DeleteMetricFilter and cloudwatch:DeleteAlarms for the backout plan - A CloudTrail trail, preferably multi-region, that sends its events to a CloudWatch Logs log group - An Amazon SNS topic with confirmed subscribers (for example, the security team's email address) to receive the alarm notifications **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS CloudTrail console and select **Trails**. 3. Open each trail and, in the **CloudWatch Logs** section, note the log group the trail sends events to. 4. Open the Amazon CloudWatch console in the region of that log group, choose **Log groups** and select the log group. 5. Open the **Metric filters** tab and check for a filter whose pattern includes these conditions: $.eventName = ConsoleLogin and $.errorMessage = "Failed authentication". 6. Note the metric name of that filter, then choose **Alarms**, **All alarms** and check that an alarm exists for that metric. 7. If no trail's log group has such a metric filter with an alarm, follow the implementation steps. **CLI:** List the trails and the CloudWatch Logs log group each one sends events to: aws cloudtrail describe-trails --region --query "trailList\[\].\[Name,HomeRegion,IsMultiRegionTrail,CloudWatchLogsLogGroupArn\]" --output table List the metric filters of the log group (the name after log-group: in the ARN), in the region of the log group: aws logs describe-metric-filters --region --log-group-name --query "metricFilters\[\].\[filterName,filterPattern,metricTransformations\[0\].metricName,metricTransformations\[0\].metricNamespace\]" --output table List the alarms on the metric of the matching filter: aws cloudwatch describe-alarms-for-metric --region --metric-name --namespace --query "MetricAlarms\[\].\[AlarmName,StateValue,ActionsEnabled\]" --output table The account fails if no trail sends events to a log group, if no metric filter on a trail's log group has a pattern that includes all of the conditions listed above, or if no alarm exists for the metric of that filter. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. If no trail sends events to CloudWatch Logs, open the AWS CloudTrail console, open a multi-region trail, choose **Edit** in the **CloudWatch Logs** section, enable it, select or create a log group and an IAM role, and save the changes. 3. Open the Amazon CloudWatch console in the region of the trail's log group, choose **Log groups** and select the log group. 4. Open the **Metric filters** tab and choose **Create metric filter**. 5. In **Filter pattern**, enter { ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") } and choose **Next**. 6. Enter the metric details and choose **Next**: - **Filter name**: console\_signin\_failures - **Metric namespace**: CISBenchmark - **Metric name**: console\_signin\_failures\_metric - **Metric value**: 1 7. Choose **Create metric filter**. 8. On the **Metric filters** tab, select the new filter and choose **Create alarm**. 9. Set the metric and conditions, then choose **Next**: - **Statistic**: **Sum** - **Period**: **5 minutes** - **Threshold type**: **Static**, **Greater/Equal**, 1 10. Under **Notification**, select the SNS topic that alerts the security team and choose **Next**. 11. Enter the alarm name console\_signin\_failures\_alarm, choose **Next**, then **Create alarm**. **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon CloudWatch console, choose **Alarms**, **All alarms**, select the console\_signin\_failures\_alarm alarm and delete it. 3. Choose **Log groups**, select the trail's log group, open the **Metric filters** tab, select the console\_signin\_failures filter and delete it. **CLI:** aws cloudwatch delete-alarms --region --alarm-names console\_signin\_failures\_alarm aws logs delete-metric-filter --region --log-group-name --filter-name console\_signin\_failures Note: removing the metric filter and alarm stops alerts for failed AWS Management Console sign-in attempts, so these events can again go unnoticed. **Reference** - [https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Alarm-On-Logs.html](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Alarm-On-Logs.html) - [https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html](https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.