CloudWatch Logs metric filter and alarm exist for IAM policy changes
cloudwatch_log_metric_filter_policy_changes
CloudWatch uses a metric filter and alarm to track IAM policy changes recorded by CloudTrail (e.g., CreatePolicy, DeletePolicy, version changes, inline policy edits, policy attach/detach). This finding reflects whether that filter and an associated alarm are present on the trail's log group.
Risk
Absent alerting on IAM policy changes, privilege modifications can go unnoticed, enabling privilege escalation, hidden backdoors, or permission revocations. This threatens confidentiality and integrity, and may impact availability if critical access is removed or misconfigured.
prowler aws --checks cloudwatch_log_metric_filter_policy_changes
Recommendation
Create a metric filter for IAM policy create/update/delete and attach/detach events with an alarm to notify responders.
- Enforce least privilege and separation of duties for policy changes
- Require approvals and central logging across Regions/accounts
- Integrate alerts with incident response
Remediation
- Open the CloudWatch console > Logs > Log groups and select the CloudTrail log group
- Create metric filter:
- Filter pattern: {($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}
- Metric name: <example_resource_name>
- Namespace: CISBenchmark
- Metric value: 1
- On the Metric filters tab, select the new filter and choose Create alarm
- Set: Statistic=Sum, Period=5 minutes, Threshold type=Static, Greater/Equal, Threshold=1, Evaluation periods=1
- Create the alarm
Source Code
Resource Type
AwsCloudWatchAlarm