Check provider logo

CloudWatch Logs metric filter and alarm exist for changes to network gateways

cloudwatch_changes_to_network_gateways_alarm_configured

Severitymedium
Servicecloudwatch
by Prowler
logging

CloudWatch log metric filters and alarms for network gateway changes are identified by matching CloudTrail events such as CreateCustomerGateway, DeleteCustomerGateway, AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, and DetachInternetGateway in log groups that receive trail logs.

Risk

Without this monitoring, gateway changes can expose private networks to the Internet or break connectivity. Adversaries or mistakes can enable data exfiltration, bypass network inspection, and trigger outages via deletions or detachments, impacting confidentiality and availability.

Run this check with Prowler CLI

prowler aws --checks cloudwatch_changes_to_network_gateways_alarm_configured

Run in Prowler Cloud

Recommendation

Send CloudTrail to CloudWatch Logs and create a metric filter for the listed gateway events with an alarm that notifies responders. Enforce least privilege for gateway modifications, require change approvals, and route alerts to monitored channels as part of defense in depth.

Remediation

Native IaC
Terraform
Other
  1. In the AWS Console, go to CloudWatch > Logs > Log groups and open the CloudTrail log group
  2. Create metric filter:
    • Filter pattern: { ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway) }
    • Metric name: <example_resource_name>
    • Metric namespace: <example_resource_name>
    • Metric value: 1
  3. From the filter, choose Create alarm:
    • Statistic: Sum, Period: 5 minutes, Threshold: >= 1, Evaluation periods: 1
    • Create the alarm (actions optional)

Source Code

Resource Type

AwsCloudWatchAlarm

References