Check ID: cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail logs in CloudWatch Logs are inspected for a metric filter and alarm that track AWS Config configuration changes, specifically StopConfigurationRecorder, DeleteDeliveryChannel, PutDeliveryChannel, and PutConfigurationRecorder events from config.amazonaws.com.

​
Risk

Without alerting on AWS Config changes, actions like StopConfigurationRecorder or DeleteDeliveryChannel can silently suspend recording and delivery. This degrades the integrity and availability of configuration audit data, enabling undetected changes and delaying incident response.

​
Recommendation

Create a CloudWatch Logs metric filter and alarm for config.amazonaws.com events (StopConfigurationRecorder, DeleteDeliveryChannel, PutDeliveryChannel, PutConfigurationRecorder). Route CloudTrail to Logs, notify responders, and enforce least privilege and separation of duties on Config changes to prevent abuse.

​
Remediation

# CloudWatch Logs metric filter for AWS Config changes
resource "aws_cloudwatch_log_metric_filter" "config_change" {
  name           = "aws_config_changes_metric"
  log_group_name = "<example_resource_name>"
  pattern        = "{($.eventSource = config.amazonaws.com) && (($.eventName=StopConfigurationRecorder)||($.eventName=DeleteDeliveryChannel)||($.eventName=PutDeliveryChannel)||($.eventName=PutConfigurationRecorder))}" # Critical: detects AWS Config configuration change events

  metric_transformation {
    name      = "aws_config_changes_metric"   # Critical: metric used by the alarm
    namespace = "CISBenchmark"
    value     = "1"
  }
}

# Alarm for the above metric
resource "aws_cloudwatch_metric_alarm" "config_change" {
  alarm_name          = "aws_config_changes_alarm"
  metric_name         = "aws_config_changes_metric"   # Critical: ties alarm to the metric filter
  namespace           = "CISBenchmark"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  period              = 300
  statistic           = "Sum"
  threshold           = 1  # Critical: alarm on first occurrence
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks