Check ID: cloudwatch_log_metric_filter_authentication_failures
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures, sourced from CloudTrail (eventName=ConsoleLogin, errorMessage="Failed authentication"). Identifies whether these failures are converted into a metric and actively monitored by an alarm.

​
Risk

Absent visibility into failed console logins enables undetected brute-force and credential-stuffing attempts, extending attacker dwell time. Successful guesses can grant console access, risking data confidentiality, configuration integrity, and availability through destructive changes.

​
Recommendation

Implement a log metric filter for ConsoleLogin failures and attach a CloudWatch alarm with actionable notifications. Tune thresholds to reduce noise and route alerts to incident response. Apply least privilege and enforce MFA to limit impact, and correlate alerts with source IP and user context.

​
Remediation

# Metric filter and alarm for console authentication failures
resource "aws_cloudwatch_log_metric_filter" "metric" {
  name           = "<example_resource_name>"
  log_group_name = "<example_resource_name>"
  pattern        = "{($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }" # Critical: detects failed console logins

  metric_transformation {
    name      = "<example_resource_name>"   # Critical: metric created by filter
    namespace = "<example_resource_name>"   # Critical: metric namespace
    value     = "1"
  }
}

resource "aws_cloudwatch_metric_alarm" "alarm" {
  metric_name          = aws_cloudwatch_log_metric_filter.metric.metric_transformation[0].name   # Critical: alarm references the filter's metric
  namespace            = aws_cloudwatch_log_metric_filter.metric.metric_transformation[0].namespace # Critical: must match
  comparison_operator  = "GreaterThanOrEqualToThreshold"
  evaluation_periods   = 1
  period               = 300
  statistic            = "Sum"
  threshold            = 1
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_authentication_failures. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks