Check provider logo

CloudWatch Logs metric filter and alarm exist for security group changes

cloudwatch_log_metric_filter_security_group_changes

Severitymedium
Servicecloudwatch
by Prowler
logging

CloudTrail events for security group configuration changes are monitored using a CloudWatch Logs metric filter with an associated alarm. The filter targets actions like AuthorizeSecurityGroupIngress/Egress, RevokeSecurityGroupIngress/Egress, CreateSecurityGroup, and DeleteSecurityGroup to surface any security group modifications.

Risk

Without alerting on security group changes, unauthorized or mistaken rules can expose services to the Internet, enabling brute force and lateral movement (confidentiality, integrity). Deletions or restrictive edits can break connectivity (availability). Delayed detection increases attacker dwell time and impact.

Run this check with Prowler CLI

prowler aws --checks cloudwatch_log_metric_filter_security_group_changes

Run in Prowler Cloud

Recommendation

Establish real-time alerts for security group modifications by sending CloudTrail to CloudWatch, creating metric filters and alarms, and notifying responders.

  • Enforce least privilege on SG changes
  • Use change management and tagging
  • Centralize logs, test alarms, and maintain runbooks
  • Layer with NACLs and WAF for defense in depth

Remediation

Native IaC
Terraform
Other
  1. Open the CloudWatch console > Logs > Log groups, and select the CloudTrail log group
  2. Create metric filter with this pattern: { ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }
  3. Assign metric: name <example_metric_name>, namespace <example_metric_namespace>, value 1, then create the filter
  4. From the metric filter, choose Create alarm and set: Statistic Sum, Period 5 minutes, Threshold type Static, Greater/Equal 1, Evaluation periods 1, then create the alarm

Source Code

Resource Type

AwsCloudWatchAlarm

References