Check ID: cloudwatch_log_metric_filter_sign_in_without_mfa
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail logs in CloudWatch are assessed for a metric filter and alarm that detect console logins where $.eventName = ConsoleLogin and $.additionalEventData.MFAUsed != \"Yes\". This reflects whether alerting exists for sign-ins that occur without MFA.

​
Risk

Without alerting on non-MFA console logins, successful use of stolen passwords can go undetected, enabling:
  • Unauthorized console access and IAM changes
  • Data exfiltration or deletion
Impacts: loss of confidentiality and integrity, and potential availability disruption.

​
Recommendation

Enforce MFA for all console-capable identities and maintain alerts for ConsoleLogin with MFAUsed != \"Yes\". Apply least privilege, route alarms to monitored channels, and tune for SSO to reduce noise. Test alarms regularly and review coverage as part of defense in depth.

​
Remediation

# Create metric filter for console sign-in without MFA
resource "aws_cloudwatch_log_metric_filter" "nomfa" {
  name           = "<example_resource_name>"
  log_group_name = "<example_resource_name>"
  pattern        = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") }"  # CRITICAL: detects ConsoleLogin without MFA

  metric_transformation {
    name      = "<example_resource_name>"
    namespace = "<example_resource_name>"
    value     = "1"  # CRITICAL: emits a count per match
  }
}

# Alarm on the emitted metric
resource "aws_cloudwatch_metric_alarm" "nomfa" {
  alarm_name          = "<example_resource_name>"
  metric_name         = aws_cloudwatch_log_metric_filter.nomfa.metric_transformation[0].name  # CRITICAL: ties alarm to the metric
  namespace           = aws_cloudwatch_log_metric_filter.nomfa.metric_transformation[0].namespace
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  period              = 300
  statistic           = "Sum"
  threshold           = 1  # CRITICAL: alarm on first event
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_sign_in_without_mfa. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks