Ensure a log metric filter and alarm exist for VPC changes

Rule Description:

Troubleshooting Steps:

2. 1.
   Ensure that the required AWS account has the necessary permissions to create and manage log metrics filters and alarms.
4. 2.
   Validate if the desired VPC changes are being captured in the logs.
6. 3.
   Check if CloudWatch Logs and CloudWatch Alarms are properly configured and integrated with the VPC in question.
8. 4.
   Verify if the log metric filter and alarm configurations meet the requirements specified in the CIS benchmark.

Necessary Codes (if applicable):

Remediation Steps:

Step 1: Creating a Log Metric Filter

2. 1.
   Go to the AWS Management Console and navigate to the CloudWatch service.
4. 2.
   In the navigation pane, click on "Logs" and select the desired log group.
6. 3.
   Click on the "Create Metric Filter" button.
8. 4.
   In the "Filter Pattern" section, input the following filter pattern:

{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AttachVpnGateway) || ($.eventName = DetachVpnGateway) || ($.eventName = EnableVgwRoutePropagation) || ($.eventName = DisableVgwRoutePropagation) || ($.eventName = AssociateVpcCidrBlock) || ($.eventName = DisassociateVpcCidrBlock) || ($.eventName = CreateRoute) || ($.eventName = ReplaceRoute) || ($.eventName = DeleteRoute) }

2. 1.
   Choose a log group from the drop-down list or create a new one.
4. 2.
   In the "Metric Details" section, provide a name and namespace for the metric.
6. 3.
   Click on "Create Filter" to save the log metric filter.

Step 2: Creating an Alarm

2. 1.
   While still in the CloudWatch service, click on "Alarms" in the navigation pane.
4. 2.
   Click on the "Create Alarm" button.
6. 3.
   Select the log metric filter created in the previous step from the list of metrics.
8. 4.
   Configure the threshold conditions for the alarm, such as the "Whenever" and "Threshold" values.
10. 5.
    Specify the actions to be taken when the alarm state is triggered, such as sending notifications or initiating automated responses.
12. 6.
    Provide a name and description for the alarm.
14. 7.
    Click on "Create Alarm" to save the alarm configuration.

Verification:

2. 1.
   Go to the AWS Management Console and navigate to the CloudWatch service.
4. 2.
   In the navigation pane, click on "Alarms" and locate the alarm created for VPC changes.
6. 3.
   Confirm that the alarm's state is "OK" or "INSUFFICIENT_DATA." If it is in an "ALARM" state, there might be a VPC change detected.
8. 4.
   If the alarm is triggered, investigate the VPC changes in the associated CloudWatch Logs to ensure they are authorized and expected.