Check ID: cloudwatch_changes_to_network_route_tables_alarm_configured
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

VPC route table changes are captured from CloudTrail logs by a CloudWatch Logs metric filter with an associated alarm for events like CreateRoute, CreateRouteTable, ReplaceRoute, ReplaceRouteTableAssociation, DeleteRoute, DeleteRouteTable, and DisassociateRouteTable.

​
Risk

Without monitoring of route table changes, unauthorized or accidental edits can redirect traffic, bypass inspection, or blackhole routes, impacting confidentiality (exfiltration), integrity (tampered paths), and availability (outages from misrouted traffic).

​
Recommendation

Implement a CloudWatch Logs metric filter and alarm on CloudTrail for these route table events and notify responders. Enforce least privilege for route modifications, require change control, and apply defense in depth with VPC Flow Logs and guardrails to prevent and quickly contain unsafe routing changes.

​
Remediation

# Metric filter + alarm for VPC route table changes
resource "aws_cloudwatch_log_metric_filter" "routes" {
  name           = "<example_resource_name>"
  log_group_name = "<example_resource_name>"
  # CRITICAL: Detect EC2 route table change events in CloudTrail logs
  pattern = "{($.eventSource = ec2.amazonaws.com) && (($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable))}"

  metric_transformation {
    name      = "<example_resource_name>"
    namespace = "<example_resource_name>"
    value     = "1"
  }
}

resource "aws_cloudwatch_metric_alarm" "routes" {
  alarm_name          = "<example_resource_name>"
  # CRITICAL: Alarm targets the metric from the filter above
  metric_name         = "<example_resource_name>"
  namespace           = "<example_resource_name>"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  period              = 300
  statistic           = "Sum"
  threshold           = 1
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_changes_to_network_route_tables_alarm_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks