Check provider logo

CloudWatch log metric filter and alarm exist for Network ACL (NACL) change events

cloudwatch_changes_to_network_acls_alarm_configured

Severitymedium
Servicecloudwatch
by Prowler
logging

CloudTrail records for Network ACL changes are matched by a CloudWatch Logs metric filter with an associated alarm for events like CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, ReplaceNetworkAclEntry, and ReplaceNetworkAclAssociation.

Risk

Absent monitoring of NACL changes reduces detection of policy tampering, risking loss of confidentiality (opened ingress/egress), degraded network integrity (lateral movement, bypassed segmentation), and reduced availability (traffic blackholes or lockouts).

Run this check with Prowler CLI

prowler aws --checks cloudwatch_changes_to_network_acls_alarm_configured

Run in Prowler Cloud

Recommendation

Implement a CloudWatch Logs metric filter and alarm for NACL change events from CloudTrail and route alerts to responders. Enforce least privilege on NACL management, require change control, and use defense in depth with configuration monitoring and flow logs to validate and monitor network posture.

Remediation

Native IaC
Terraform
Other
  1. In the AWS Console, go to CloudWatch > Log groups and open the CloudTrail log group
  2. Metric filters tab > Create metric filter
  3. Set Filter pattern to: { ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }
  4. Next > Filter name: nacl_changes; Metric namespace: CISBenchmark; Metric name: nacl_changes; Metric value: 1 > Create metric filter
  5. Select the new metric filter > Create alarm
  6. Set Statistic: Sum, Period: 5 minutes, Threshold type: Static, Condition: Greater/Equal, Threshold: 1
  7. Next through actions (optional) > Name: nacl_changes > Create alarm

Source Code

Resource Type

AwsCloudWatchAlarm

References