Check ID: cloudwatch_log_metric_filter_security_group_changes
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail events for security group configuration changes are monitored using a CloudWatch Logs metric filter with an associated alarm. The filter targets actions like AuthorizeSecurityGroupIngress/Egress, RevokeSecurityGroupIngress/Egress, CreateSecurityGroup, and DeleteSecurityGroup to surface any security group modifications.

​
Risk

Without alerting on security group changes, unauthorized or mistaken rules can expose services to the Internet, enabling brute force and lateral movement (confidentiality, integrity). Deletions or restrictive edits can break connectivity (availability). Delayed detection increases attacker dwell time and impact.

​
Recommendation

Establish real-time alerts for security group modifications by sending CloudTrail to CloudWatch, creating metric filters and alarms, and notifying responders.
  • Enforce least privilege on SG changes
  • Use change management and tagging
  • Centralize logs, test alarms, and maintain runbooks
  • Layer with NACLs and WAF for defense in depth

​
Remediation

# Metric filter for Security Group changes
resource "aws_cloudwatch_log_metric_filter" "sg" {
  name           = "<example_resource_name>"
  log_group_name = "<example_log_group_name>"
  # Critical: Matches Security Group change events required by the check
  pattern = "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }"

  metric_transformation {
    name      = "<example_metric_name>"
    namespace = "<example_metric_namespace>"
    value     = "1"
  }
}

# Alarm for the above metric
resource "aws_cloudwatch_metric_alarm" "sg" {
  alarm_name          = "<example_resource_name>"
  # Critical: Alarm on the SG change metric to pass the control
  metric_name         = "<example_metric_name>"
  namespace           = "<example_metric_namespace>"
  statistic           = "Sum"
  period              = 300
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_security_group_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks