Ensure a Log Metric Filter and Alarm Exist for Usage of 'root' Account Rule

Rule Description

Troubleshooting Steps (if applicable)

2. 1.
   Verify that the necessary permissions are assigned to the user to create log metric filters and alarms.
4. 2.
   Check the CloudWatch Logs to confirm if any existing log metric filters and alarms are present for 'root' account usage.
6. 3.
   Ensure that the correct filter pattern is used to match 'root' account usage.
8. 4.
   Verify that the alarm actions are properly configured to trigger appropriate notifications or actions when 'root' account usage is detected.

Necessary Code (if applicable)

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  RootAccountLogMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: /var/log/auth.log   # Replace with the appropriate log group name
      FilterPattern: '[root]'
      MetricTransformations:
        - MetricName: RootAccountUsage
          MetricNamespace: CIS/Security
          MetricValue: 1

  RootAccountUsageAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: RootAccountUsageAlarm
      AlarmDescription: Alarm triggered for 'root' account usage
      Namespace: CIS/Security
      MetricName: RootAccountUsage
      ComparisonOperator: GreaterThanOrEqualToThreshold
      Threshold: 1
      EvaluationPeriods: 1
      Statistic: SampleCount
      Period: 300  # 5 minutes
      AlarmActions:
        - <ARN of SNS Topic or other action to be triggered>

Remediation Steps

2. 1.
   Open the AWS Management Console and navigate to the CloudWatch service.
4. 2.
   In the left sidebar, click on "Log groups" under "Logs".
6. 3.
   Search for the log group that contains the logs for 'root' account usage (e.g., '/var/log/auth.log').
8. 4.
   Click on the log group to open detailed log views.
10. 5.
    In the top-right corner, click on the "Create metric filter" button.
12. 6.
    Set the filter pattern to '[root]'.
14. 7.
    Configure the filter name and choose an appropriate metric namespace and value.
16. 8.
    Click on "Assign metric".
18. 9.
    In the Alarm section, click on "Create an alarm".
20. 10.
    Configure the alarm name, description, threshold, and alarm actions according to your requirements. Ensure that the period is set to 5 minutes.
22. 11.
    Click on "Create alarm" to finalize the setup.