Ensure a Log Metric Filter and Alarm Exist for Security Group Changes Rule

Rule Description:

Remediation Steps:

Log Metric Filter Configuration:

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the CloudWatch service.
6. 3.
   In the CloudWatch dashboard, select "Logs" from the left-hand menu.
8. 4.
   Choose the appropriate log group that contains your VPC Flow Logs.
10. 5.
    Click on "Create Metric Filter" at the top-right corner.

Filter Pattern:

2. 1.

   Enter a filter pattern that matches security group changes in the logs.

   Filter pattern example:

   {($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress)}
   

Assign Metric:

2. 1.
   After entering the filter pattern, click on the "Assign Metric" button to define the metric for the filter.
4. 2.
   Provide a name for the metric.
6. 3.
   Define a metric value that represents the log events matching the filter pattern.
8. 4.
   Click on the "Create Filter" button to save the filter.

Alarm Configuration:

2. 1.
   From the left-hand menu, select "Alarms" in the CloudWatch dashboard.
4. 2.
   Click on "Create Alarm" to start configuring the alarm.
6. 3.
   Select the metric filter you created in the previous steps.
8. 4.
   Set the threshold conditions for the alarm based on your requirements.
10. 5.
    Configure the actions to be taken when the alarm state is triggered (e.g., sending notifications, triggering auto-remediation, etc.).
12. 6.
    Review the alarm settings and click on the "Create Alarm" button to save the alarm.

Troubleshooting Steps:

2. 1.
   Check if your VPC Flow Logs are enabled and properly configured.
4. 2.
   Ensure that the log group selected for the filter contains the VPC Flow Logs.
6. 3.
   Validate that the filter pattern is correctly entered and matches the security group change events in the logs.
8. 4.
   Verify that the filter is assigned to the intended metric.
10. 5.
    Double-check the threshold conditions set in the alarm configuration.
12. 6.
    Ensure that the actions configured for the alarm are appropriate and functional.

Code (if applicable):

Additional Notes: