CloudWatchAlarmsForCloudTrailAPIActivity-Template.yaml

#
# Taken From the AWS Suggested Template found at:
# https://s3-us-west-2.amazonaws.com/awscloudtrail/cloudwatch-alarms-for-cloudtrail-api-activity/CloudWatch_Alarms_for_CloudTrail_API_Activity.json
#

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudTrail API Activity Alarm Template for CloudWatch Logs


Parameters:
  pLogGroupName:
    Type: String
    Default: CloudTrail/DefaultLogGroup
    Description: Enter CloudWatch Logs log group name. Default is CloudTrail/DefaultLogGroup
  pParanoiaLevel:
    Type: String
    Description: Level of alerting to use (defined in mappings)
    Default: TopicAlertsNormal
    AllowedValues:
    - TopicAlertsNormal
    - TopicAlertsParanoid
    - TopicAlertsLax

  pDashboardName:
    Type: String
    Description: Name of the Dashboard to create with the Alerts and Stuff
    Default: Security

Mappings:
  TopicAlertsNormal:
    SecurityGroupChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    # Covers NACL, Gateway, & VPC changes
    VpcChangesAlarm:
      TopicArn:  SNSAlertsCriticalArn
    ConsoleSignInFailuresAlarm:
      TopicArn: SNSAlertsErrorArn
    EC2InstanceChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    EC2LargeInstanceChangesAlarm:
      TopicArn: SNSAlertsErrorArn
    CloudTrailChangesAlarm:
      TopicArn: SNSAlertsCriticalArn
    IAMPolicyChangesAlarm:
      TopicArn: SNSAlertsInfoArn
  TopicAlertsParanoid:
    SecurityGroupChangesAlarm:
      TopicArn: SNSAlertsErrorArn
    # Covers NACL, Gateway, & VPC changes
    VpcChangesAlarm:
      TopicArn: SNSAlertsCriticalArn
    ConsoleSignInFailuresAlarm:
      TopicArn: SNSAlertsErrorArn
    EC2InstanceChangesAlarm:
      TopicArn: SNSAlertsErrorArn
    EC2LargeInstanceChangesAlarm:
      TopicArn: SNSAlertsErrorArn
    CloudTrailChangesAlarm:
      TopicArn: SNSAlertsCriticalArn
    IAMPolicyChangesAlarm:
      TopicArn: SNSAlertsCriticalArn
  TopicAlertsLax:
    SecurityGroupChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    # Covers NACL, Gateway, & VPC changes
    VpcChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    ConsoleSignInFailuresAlarm:
      TopicArn: SNSAlertsInfoArn
    EC2InstanceChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    EC2LargeInstanceChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    CloudTrailChangesAlarm:
      TopicArn: SNSAlertsInfoArn
    IAMPolicyChangesAlarm:
      TopicArn: SNSAlertsInfoArn


# Each Resource consists of a Metric Filter and an Alarm on that Metric Filter
Resources:

  # Info level alert as these happen frequently
  SecurityGroupChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName
        = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress)
        || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup)
        || ($.eventName = DeleteSecurityGroup) }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: SecurityGroupEventCount
        MetricValue: '1'
  SecurityGroupChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailSecurityGroupChanges
      AlarmDescription: Alarms when an API call is made to create, update or delete a Security Group.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, SecurityGroupChangesAlarm, TopicArn ]
      MetricName: SecurityGroupEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  # Error Level Event, this should be infrequent
  NetworkAclChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry)
        || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry)
        || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation)
        }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: NetworkAclEventCount
        MetricValue: '1'
  NetworkAclChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailNetworkAclChanges
      AlarmDescription: Alarms when an API call is made to create, update or delete a Network ACL.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, VpcChangesAlarm, TopicArn ]
      MetricName: NetworkAclEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  GatewayChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway)
        || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway)
        || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway)
        }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: GatewayEventCount
        MetricValue: '1'
  GatewayChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailGatewayChanges
      AlarmDescription: Alarms when an API call is made to create, update or delete
        a Customer or Internet Gateway.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, VpcChangesAlarm, TopicArn ]
      MetricName: GatewayEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  VpcChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) ||
        ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection)
        || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection)
        || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc)
        || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink)
        || ($.eventName = EnableVpcClassicLink) }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: VpcEventCount
        MetricValue: '1'
  VpcChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailVpcChanges
      AlarmDescription: Alarms when an API call is made to create, update or delete
        a VPC, VPC peering connection or VPC connection to classic.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, VpcChangesAlarm, TopicArn ]
      MetricName: VpcEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  EC2InstanceChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = RunInstances) || ($.eventName = RebootInstances)
        || ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName
        = TerminateInstances) }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: EC2InstanceEventCount
        MetricValue: '1'
  EC2InstanceChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailEC2InstanceChanges
      AlarmDescription: Alarms when an API call is made to create, terminate, start, stop or reboot an EC2 instance.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, EC2InstanceChangesAlarm, TopicArn ]
      MetricName: EC2InstanceEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  EC2LargeInstanceChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = RunInstances) && (($.requestParameters.instanceType
        = *.8xlarge) || ($.requestParameters.instanceType = *.4xlarge)) }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: EC2LargeInstanceEventCount
        MetricValue: '1'
  EC2LargeInstanceChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailEC2LargeInstanceChanges
      AlarmDescription: Alarms when an API call is made to create, terminate, start, stop or reboot a 4x or 8x-large EC2 instance.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, EC2LargeInstanceChangesAlarm, TopicArn ]
      MetricName: EC2LargeInstanceEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  CloudTrailChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)
        || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName
        = StopLogging) }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: CloudTrailEventCount
        MetricValue: '1'
  CloudTrailChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailChanges
      AlarmDescription: Alarms when an API call is made to create, update or delete a CloudTrail trail, or to start or stop logging to a trail.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, CloudTrailChangesAlarm, TopicArn ]
      MetricName: CloudTrailEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  ConsoleSignInFailuresMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: ConsoleSignInFailureCount
        MetricValue: '1'
  ConsoleSignInFailuresAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailConsoleSignInFailures
      AlarmDescription: Alarms when an unauthenticated API call is made to sign int the console.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, ConsoleSignInFailuresAlarm, TopicArn ]
      MetricName: ConsoleSignInFailureCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '3'
      TreatMissingData: notBreaching

  AuthorizationFailuresMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{ ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") && $.userIdentity.invokedBy != "AWS Internal" }'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: AuthorizationFailureCount
        MetricValue: '1'
  AuthorizationFailuresAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailAuthorizationFailures
      AlarmDescription: Alarms when an unauthorized API call is made.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, ConsoleSignInFailuresAlarm, TopicArn ]
      MetricName: AuthorizationFailureCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching

  IAMPolicyChangesMetricFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref pLogGroupName
      FilterPattern: '{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}'
      MetricTransformations:
      - MetricNamespace: CloudTrailMetrics
        MetricName: IAMPolicyEventCount
        MetricValue: '1'
  IAMPolicyChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CloudTrailIAMPolicyChanges
      AlarmDescription: Alarms when an API call is made to change an IAM policy.
      AlarmActions:
        - Fn::ImportValue:
            Fn::FindInMap: [ !Ref pParanoiaLevel, IAMPolicyChangesAlarm, TopicArn ]
      MetricName: IAMPolicyEventCount
      Namespace: CloudTrailMetrics
      ComparisonOperator: GreaterThanOrEqualToThreshold
      EvaluationPeriods: '1'
      Period: '300'
      Statistic: Sum
      Threshold: '1'
      TreatMissingData: notBreaching


Outputs:

  TemplateVersion:
    Value: 1.0.0