Check provider logo

Account has a CloudWatch Logs metric filter and alarm for root account usage

cloudwatch_log_metric_filter_root_usage

Severitymedium
Servicecloudwatch
by Prowler
logging

CloudTrail logs in CloudWatch include a metric filter for root account activity ({ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }) and a linked CloudWatch alarm that triggers when the filter matches.

Risk

Without alerting on root activity, full-privilege actions can proceed unnoticed, impacting:

  • confidentiality via data access/exfiltration
  • integrity via policy/config tampering
  • availability via deletions or shutdowns Delayed detection increases blast radius and persistence.
Run this check with Prowler CLI

prowler aws --checks cloudwatch_log_metric_filter_root_usage

Run in Prowler Cloud

Recommendation

Enable real-time alerts for root activity using a log metric filter and a high-priority alarm with notifications.

Reduce exposure: enforce least privilege, keep root for break-glass with MFA, disable root access keys, and route alerts into incident response for defense in depth.

Remediation

Native IaC
Terraform
Other
  1. In the AWS console, open CloudWatch > Logs > Log groups and select the CloudTrail log group
  2. Go to Metric filters > Create metric filter
  3. For Filter pattern, enter: { $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }
  4. Click Next, set any Filter name, set Metric namespace and Metric name, set Metric value to 1, then Create metric filter
  5. Select the new metric filter and click Create alarm
  6. Set Period to 5 minutes, Statistic to Sum, Threshold type Static with value 1, Evaluation periods 1, then Create alarm

Source Code

Resource Type

AwsCloudWatchAlarm

References