Ensure CloudWatch alarm action is enabled to meet security standards.
Rule | CloudWatch alarm action should be enabled |
Framework | FedRAMP Moderate Revision 4 |
Severity | ✔ High |
Rule Description: CloudWatch Alarm Action Enabled for FedRAMP Moderate Revision 4
Description:
This rule ensures that the required CloudWatch Alarm actions are enabled for FedRAMP Moderate Revision 4 compliance.
Troubleshooting Steps:
If the CloudWatch Alarm actions are not enabled, follow the steps below to troubleshoot the issue:
Check if the CloudWatch Alarm exists:
Verify the Alarm configuration:
Check Alarm action permissions:
Verify the Alarm state:
Review CloudWatch Alarm history:
Consult AWS documentation or contact AWS Support:
Remediation:
If the CloudWatch Alarm actions are not enabled for FedRAMP Moderate Revision 4, follow the steps below for remediation:
Access the AWS Management Console.
Open the CloudWatch service.
In the CloudWatch console, navigate to the Alarms section.
Locate the specific CloudWatch Alarm related to the FedRAMP Moderate Revision 4 compliance.
Select the Alarm and click on the "Actions" drop-down menu.
Choose the desired Alarm action, such as sending an Amazon SNS notification, triggering an Auto Scaling policy, or stopping an Amazon EC2 instance.
Configure the necessary parameters for the selected Alarm action.
Save the changes made to the CloudWatch Alarm configuration.
Verify that the Alarm actions are enabled by triggering the Alarm threshold or manually testing the action.
Monitor the Alarm status and ensure that the appropriate actions are taken as desired.
Necessary Code:
If using the AWS CLI, you can enable CloudWatch Alarm actions by using the
put-metric-alarm
command. Below is an example command:aws cloudwatch put-metric-alarm --alarm-name MyFedRAMPAlarm --alarm-description "Alarm for FedRAMP Moderate Revision 4 compliance" --actions-enabled --metric-name CPUUtilization --namespace AWS/EC2 --statistic Average --period 60 --threshold 80 --comparison-operator GreaterThanThreshold --dimensions Name=InstanceId,Value=i-1234567890abcdef0 --alarm-actions arn:aws:sns:us-west-2:123456789012:MyTopic
Make sure to replace the placeholders in the command (
MyFedRAMPAlarm
, i-1234567890abcdef0
, arn:aws:sns:us-west-2:123456789012:MyTopic
) with the appropriate values for your environment.Remember to also ensure that the IAM role associated with the alarm has the necessary permissions to execute the actions specified in the
--alarm-actions
parameter.Accelerating SEO:
To accelerate SEO for this rule, ensure the following: