Ensure a Log Metric Filter and Alarm Exist for VPC Changes Rule

Rule Description:

Troubleshooting Steps:

2. 1.

   Verify VPC Flow Logs:

   • Ensure that VPC flow logs are enabled on the VPCs you want to monitor.
   • Check if the VPC flow logs are correctly delivering logs to the configured destination (e.g., CloudWatch Logs).
4. 2.

   Confirm Log Metric Filter:

   • Verify if a log metric filter exists for VPC changes.
   • Ensure that the log metric filter pattern correctly captures log events related to VPC changes.
6. 3.

   Validate Alarm Configuration:

   • Check if an alarm is configured to monitor the log metric filter.
   • Verify that the alarm thresholds and actions are set up correctly.
8. 4.

   Verify Event History:

   • Check the event history related to the VPC changes in the CloudTrail logs.
   • Identify if there are any unauthorized or unexpected VPC modifications.

Necessary Codes:

Remediation Steps:

2. 1.

   Enable VPC Flow Logs:

   • To enable VPC flow logs, navigate to the Amazon VPC console.
   • Select the desired VPC and click on the "Actions" button.
   • Choose "Create Flow Log" and configure the log settings as per your requirements, selecting the appropriate destination (e.g., CloudWatch Logs).
4. 2.

   Create Log Metric Filter:

   • Go to the CloudWatch console.
   • Select the appropriate log group where VPC flow logs are delivered.
   • Click on "Create Metric Filter" to define the filter pattern.
   • Specify a filter pattern that captures VPC changes, such as:

     { ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) }
     

   • Configure the log metric filter details, such as the metric namespace, metric name, and value extracted from the logs.
   • Click on "Test Pattern" to verify that the filter matches the expected log events.
   • Lastly, click on "Create Filter" to create the log metric filter.
6. 3.

   Set up an Alarm:

   • After creating the log metric filter, select the "Create Alarm" option.
   • Define the alarm threshold based on your requirements (e.g., triggering an alarm if the metric value is greater than zero).
   • Configure the actions to be performed when the alarm state changes.
   • Specify the notification recipients who will be alerted when the alarm state changes (e.g., an email or an SNS topic).
   • Click on "Create Alarm" to complete the process.

Summary: