Check ID: cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail logs include a metric filter for trail configuration events (CreateTrail, UpdateTrail, DeleteTrail, StartLogging, StopLogging) with an associated CloudWatch alarm to alert on matches. Evaluates the presence of this filter-and-alarm monitoring.

​
Risk

Absent this monitoring, logging can be stopped or altered without notice, eroding visibility. That enables covert activity and data exfiltration without audit evidence, harming confidentiality, the integrity of records, and the availability of reliable logs for detection and forensics.

​
Recommendation

Implement a metric filter for trail configuration events and a linked alarm that notifies response channels. Apply least privilege and separation of duties for trail changes, add defense in depth with centralized logging and validation, and regularly test that alerts fire.

​
Remediation

resource "aws_cloudwatch_log_metric_filter" "cfg" {
  name           = "<example_resource_name>"
  log_group_name = "<example_resource_name>" # CRITICAL: CloudTrail log group
  pattern        = "{($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging)}" # CRITICAL: Detects CloudTrail config changes

  metric_transformation {
    name      = "<example_resource_name>"   # CRITICAL: Metric created by filter
    namespace = "<example_resource_name>"
    value     = "1"
  }
}

resource "aws_cloudwatch_metric_alarm" "cfg" {
  metric_name         = "<example_resource_name>" # CRITICAL: Uses metric from filter
  namespace           = "<example_resource_name>"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  period              = 300
  statistic           = "Sum"
  threshold           = 1
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks