Check ID: cloudwatch_changes_to_network_acls_alarm_configured
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail records for Network ACL changes are matched by a CloudWatch Logs metric filter with an associated alarm for events like CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, ReplaceNetworkAclEntry, and ReplaceNetworkAclAssociation.

​
Risk

Absent monitoring of NACL changes reduces detection of policy tampering, risking loss of confidentiality (opened ingress/egress), degraded network integrity (lateral movement, bypassed segmentation), and reduced availability (traffic blackholes or lockouts).

​
Recommendation

Implement a CloudWatch Logs metric filter and alarm for NACL change events from CloudTrail and route alerts to responders. Enforce least privilege on NACL management, require change control, and use defense in depth with configuration monitoring and flow logs to validate and monitor network posture.

​
Remediation

# CloudWatch metric filter and alarm for NACL changes
resource "aws_cloudwatch_log_metric_filter" "nacl" {
  name           = "nacl_changes"
  log_group_name = "<example_resource_name>"  # CloudTrail log group
  pattern        = "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }"  # CRITICAL: detects NACL changes

  metric_transformation {
    name      = "nacl_changes"
    namespace = "CISBenchmark"
    value     = "1"
  }
}

resource "aws_cloudwatch_metric_alarm" "nacl" {
  alarm_name          = "nacl_changes"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "nacl_changes"   # CRITICAL: alarm targets the metric from the filter
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_changes_to_network_acls_alarm_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks