Check provider logo

Account has a CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures

cloudwatch_log_metric_filter_authentication_failures

Severitymedium
Servicecloudwatch
by Prowler
logging

CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures, sourced from CloudTrail (eventName=ConsoleLogin, errorMessage="Failed authentication").

Identifies whether these failures are converted into a metric and actively monitored by an alarm.

Risk

Absent visibility into failed console logins enables undetected brute-force and credential-stuffing attempts, extending attacker dwell time.

Successful guesses can grant console access, risking data confidentiality, configuration integrity, and availability through destructive changes.

Run this check with Prowler CLI

prowler aws --checks cloudwatch_log_metric_filter_authentication_failures

Run in Prowler Cloud

Recommendation

Implement a log metric filter for ConsoleLogin failures and attach a CloudWatch alarm with actionable notifications. Tune thresholds to reduce noise and route alerts to incident response.

Apply least privilege and enforce MFA to limit impact, and correlate alerts with source IP and user context.

Remediation

Native IaC
Terraform
Other
  1. In the AWS Console, open CloudWatch
  2. Go to Logs > Log groups and select the CloudTrail log group receiving events
  3. Open the Metric filters tab > Create metric filter
    • Filter pattern: { ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }
    • Assign any metric name and namespace, value 1, then create
  4. On the created metric filter, select it and choose Create alarm
    • Statistic: Sum, Period: 5 minutes, Threshold type: Static, Threshold: >= 1
    • Create the alarm

Source Code

Resource Type

AwsCloudWatchAlarm

References