CIS-alarms-cfn.yml

---
AWSTemplateFormatVersion: 2010-09-09
Description: CIS AWS Foundations Benchmark Metric Alarms
Parameters:
  AlarmNotificationTopicARN:
    Description:  Replace Default value with the ARN for your SNS alarm
    Default: 'arn:aws:sns:aws-region:your-account#:your-CIS-Alarms'
    Type: String
  CloudtrailLogGroupName:
    Description:  Replace Default value with the name (not ARN) for your CloudTrail's CloudWatch Log Group
    Default: 'Example-Cloudwatch-For-Trail-LogGroup'
    Type: String
Resources:
#===============================================================================================================================
# MetricFilter and CloudWatch Alarm Section
#===============================================================================================================================

# ------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.1   Ensure a log metric filter and alarm exist for unauthorized API calls (Scored)
# ------------------------------------------------------------------------------------------------------------------------------------
  UnauthorizedApiCallsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Unauthorized Activity Attempt
      AlarmDescription: Alarm if Multiple unauthorized actions or logins attempted
      MetricName: UnauthorizedAttemptCount
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  UnauthorizedApiCallsFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.errorCode = "*UnauthorizedOperation") ||
          ($.errorCode = "AccessDenied*")
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: UnauthorizedAttemptCount
  UnauthorizedApiCallsQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Unauthorized Activity Attempt
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message | 
          sort @timestamp desc | 
          filter errorCode == '*UnauthorizedOperation' or errorCode == 'AccessDenied*'

# ------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.2   Ensure a log metric filter and alarm exist for Management Console sign-in without MFA (Scored)
# ------------------------------------------------------------------------------------------------------------------------------------
  NoMfaConsoleLoginsAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Console Signin Without MFA
      AlarmDescription: Alarm if there is a Management Console sign-in without MFA
      MetricName: ConsoleSigninWithoutMFA
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  NoMfaConsoleLoginsFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = "ConsoleLogin") &&
          ($.additionalEventData.MFAUsed != "Yes")
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: ConsoleSigninWithoutMFA
  NoMfaConsoleLoginsQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Console Signin Without MFA
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message | 
          sort @timestamp desc | 
          filter eventName == 'ConsoleLogin' and responseElements.ConsoleLogin == 'Success' and additionalEventData.MFAUsed != 'Yes'

# ------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 1.1   Avoid the use of the "root" account (Scored)
# CIS AWS Foundations Benchmark - 3.3   Ensure a log metric filter and alarm exist for usage of "root" account  (Scored)
# ------------------------------------------------------------------------------------------------------------------------------------
  RootAccountLoginsAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
    - NoMfaConsoleLoginsAlarm
    Properties:
      AlarmName: CIS-Root Activity
      AlarmDescription: Alarm if a 'root' user uses the account
      MetricName: RootUserEventCount
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  RootAccountLoginsFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          $.userIdentity.type = "Root" &&
          $.userIdentity.invokedBy NOT EXISTS &&
          $.eventType != "AwsServiceEvent"
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: RootUserEventCount
  RootAccountLoginsQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Root Activity
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message | 
          sort @timestamp desc | 
          filter userIdentity.type == 'Root' and eventType != 'AwsServiceEvent'

# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.4 Ensure a log metric filter and alarm exist for IAM policy changes (Scored)
# --------------------------------------------------------------------------------------------------------------------------------------------
  IAMPolicyChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-IAM Policy Changes
      AlarmDescription: Alarm if an IAM policy changes
      MetricName: IAMPolicyChangeEventCount
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  IAMPolicyChangesFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName=DeleteGroupPolicy) ||
          ($.eventName=DeleteRolePolicy) ||
          ($.eventName=DeleteUserPolicy) ||
          ($.eventName=PutGroupPolicy) ||
          ($.eventName=PutRolePolicy) ||
          ($.eventName=PutUserPolicy) ||
          ($.eventName=CreatePolicy) ||
          ($.eventName=DeletePolicy) ||
          ($.eventName=CreatePolicyVersion) ||
          ($.eventName=DeletePolicyVersion) ||
          ($.eventName=AttachRolePolicy) ||
          ($.eventName=DetachRolePolicy) ||
          ($.eventName=AttachUserPolicy) ||
          ($.eventName=DetachUserPolicy) ||
          ($.eventName=AttachGroupPolicy) ||
          ($.eventName=DetachGroupPolicy)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: IAMPolicyChangeEventCount
  IAMPolicyChangesQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-IAM Policy Changes
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['AttachGroupPolicy', 'AttachRolePolicy', 'AttachUserPolicy', 'CreatePolicy', 'CreatePolicyVersion', 'DeleteGroupPolicy', 'DeletePolicy', 'DeletePolicyVersion', 'DeleteRolePolicy', 'DeleteUserPolicy', 'DetachGroupPolicy', 'DetachRolePolicy', 'DetachUserPolicy', 'PutGroupPolicy', 'PutRolePolicy', 'PutUserPolicy']

# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes (Scored)
# --------------------------------------------------------------------------------------------------------------------------------------------
  CloudtrailConfigChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Cloudtrail Config Changes
      AlarmDescription: Alarm if the configuration for Cloudtrail changes
      MetricName: CloudtrailConfigChangeEventCount
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  CloudtrailConfigChangesFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = CreateTrail) ||
          ($.eventName = UpdateTrail) ||
          ($.eventName = DeleteTrail) || 
          ($.eventName = StartLogging) ||
          ($.eventName = StopLogging)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: CloudtrailConfigChangeEventCount
  CloudtrailConfigChangesQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Cloudtrail Config Changes
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['CreateTrail', 'DeleteTrail', 'StartLogging', 'StopLogging', 'UpdateTrail']

# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures (Scored)
# --------------------------------------------------------------------------------------------------------------------------------------------
  FailedConsoleLoginsAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
    - RootAccountLoginsAlarm
    Properties:
      AlarmName: CIS-Console Login Failures
      AlarmDescription: Alarm if there are AWS Management Console authentication failures
      MetricName: ConsoleLoginFailures
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  FailedConsoleLoginsFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = ConsoleLogin) &&
          ($.errorMessage = "Failed authentication")
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: ConsoleLoginFailures
  FailedConsoleLoginsQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Console Login Failures
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message | 
          sort @timestamp desc | 
          filter eventName == 'ConsoleLogin' and errorMessage == 'Failed authentication'

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.7   Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  DisabledOrDeletedCmksAlarm:
    Type: AWS::CloudWatch::Alarm
    DependsOn:
    - FailedConsoleLoginsAlarm
    Properties:
      AlarmName: CIS-KMS Key Disabled or Scheduled for Deletion
      AlarmDescription: Alarm if customer created CMKs get disabled or scheduled for
        deletion
      MetricName: KMSCustomerKeyDeletion
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 60
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  DisabledOrDeletedCmksFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventSource = kms.amazonaws.com) &&
          (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: KMSCustomerKeyDeletion
  DisabledOrDeletedCmksQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-KMS Key Disabled or Scheduled for Deletion
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventSource == 'kms.amazonaws.com' and eventName in ['DisableKey', 'ScheduleKeyDeletion']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  S3BucketPolicyChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-S3 Bucket Policy Changed
      AlarmDescription: Alarm if any S3 bucket policies are changed
      MetricName: S3BucketPolicyChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  S3BucketPolicyChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventSource = s3.amazonaws.com) &&
          (($.eventName = PutBucketAcl) || 
            ($.eventName = PutBucketPolicy) || 
            ($.eventName = PutBucketCors) || 
            ($.eventName = PutBucketLifecycle) || 
            ($.eventName = PutBucketReplication) || 
            ($.eventName = DeleteBucketPolicy) || 
            ($.eventName = DeleteBucketCors) || 
            ($.eventName = DeleteBucketLifecycle) || 
            ($.eventName = DeleteBucketReplication))
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: S3BucketPolicyChanges
  S3BucketPolicyChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-S3 Bucket Policy Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventSource = 's3.amazonaws.com' and eventName in ['DeleteBucketCors', 'DeleteBucketLifecycle', 'DeleteBucketPolicy', 'DeleteBucketReplication', 'PutBucketAcl', 'PutBucketCors', 'PutBucketLifecycle', 'PutBucketPolicy', 'PutBucketReplication']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  AWSConfigConfigurationChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-AWS Config Configuration has changed
      AlarmDescription: Alarm if the configuration for AWS Config changes
      MetricName: AWSConfigConfigurationChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  AWSConfigConfigurationChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventSource = config.amazonaws.com) && 
          (($.eventName=StopConfigurationRecorder)||
           ($.eventName=DeleteDeliveryChannel)||
           ($.eventName=PutDeliveryChannel)||
           ($.eventName=PutConfigurationRecorder))
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: AWSConfigConfigurationChanges
  AWSConfigConfigurationChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-AWS Config Configuration has changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventSource = 'config.amazonaws.com' and eventName in ['DeleteDeliveryChannel', 'StopConfigurationRecorder', 'PutConfigurationRecorder', 'PutDeliveryChannel']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.10 Ensure a log metric filter and alarm exist for security group changes (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  SecurityGroupChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Security Groups Have Changed
      AlarmDescription: Alarm if there are any changes to security groups
      MetricName: SecurityGroupChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  SecurityGroupChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = AuthorizeSecurityGroupIngress) || 
          ($.eventName = AuthorizeSecurityGroupEgress) || 
          ($.eventName = RevokeSecurityGroupIngress) || 
          ($.eventName = RevokeSecurityGroupEgress) || 
          ($.eventName = CreateSecurityGroup) || 
          ($.eventName = DeleteSecurityGroup)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: SecurityGroupChanges
  SecurityGroupChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Security Groups Have Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['AuthorizeSecurityGroupIngress', 'AuthorizeSecurityGroupEgress', 'CreateSecurityGroup', 'DeleteSecurityGroup', 'RevokeSecurityGroupIngress', 'RevokeSecurityGroupEgress']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  NACLChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-NACLs Have Changed
      AlarmDescription: Alarm if there are any changes to Network ACLs (NACLs)
      MetricName: NACLChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  NACLChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = CreateNetworkAcl) || 
          ($.eventName = CreateNetworkAclEntry) || 
          ($.eventName = DeleteNetworkAcl) || 
          ($.eventName = DeleteNetworkAclEntry) || 
          ($.eventName = ReplaceNetworkAclEntry) || 
          ($.eventName = ReplaceNetworkAclAssociation)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: NACLChanges
  NACLChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-NACLs Have Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['CreateNetworkAcl', 'CreateNetworkAclEntry', 'DeleteNetworkAcl', 'DeleteNetworkAclEntry', 'ReplaceNetworkAclEntry', 'ReplaceNetworkAclAssociation']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.12 Ensure a log metric filter and alarm exist for changes to network gateways (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  NetworkGatewayChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Network Gateways Have Changed
      AlarmDescription: Alarm if there are any changes to network gateways
      MetricName: NetworkGatewayChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  NetworkGatewayChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = CreateCustomerGateway) || 
          ($.eventName = DeleteCustomerGateway) || 
          ($.eventName = AttachInternetGateway) || 
          ($.eventName = CreateInternetGateway) || 
          ($.eventName = DeleteInternetGateway) || 
          ($.eventName = DetachInternetGateway)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: NetworkGatewayChanges
  NetworkGatewayChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Network Gateways Have Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['AttachInternetGateway', 'CreateCustomerGateway', 'CreateInternetGateway', 'DeleteCustomerGateway', 'DeleteInternetGateway', 'DetachInternetGateway']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.13 Ensure a log metric filter and alarm exist for route table changes (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  RouteTableChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Route Tables Have Changed
      AlarmDescription: Alarm if there are any changes to route tables
      MetricName: RouteTableChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  RouteTableChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = CreateRoute) || 
          ($.eventName = CreateRouteTable) || 
          ($.eventName = ReplaceRoute) || 
          ($.eventName = ReplaceRouteTableAssociation) || 
          ($.eventName = DeleteRouteTable) || 
          ($.eventName = DeleteRoute) || 
          ($.eventName = DisassociateRouteTable)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: RouteTableChanges
  RouteTableChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-Route Tables Have Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['CreateRoute', 'CreateRouteTable', 'DeleteRoute', 'DeleteRouteTable', 'DisassociateRouteTable', 'ReplaceRoute', 'ReplaceRouteTableAssociation']

# -------------------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.14 Ensure a log metric filter and alarm exist for VPC changes (Scored)
# -------------------------------------------------------------------------------------------------------------------------------------------------------
  VPCChangeAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-VPC Has Changed
      AlarmDescription: Alarm if there are any changes to any VPCs
      MetricName: VPCChanges
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
      AlarmActions:
        - !Ref AlarmNotificationTopicARN
      ComparisonOperator: GreaterThanOrEqualToThreshold
  VPCChangeFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudtrailLogGroupName
      FilterPattern: |-
        {
          ($.eventName = CreateVpc) || 
          ($.eventName = DeleteVpc) || 
          ($.eventName = ModifyVpcAttribute) || 
          ($.eventName = AcceptVpcPeeringConnection) || 
          ($.eventName = CreateVpcPeeringConnection) || 
          ($.eventName = DeleteVpcPeeringConnection) || 
          ($.eventName = RejectVpcPeeringConnection) || 
          ($.eventName = AttachClassicLinkVpc) || 
          ($.eventName = DetachClassicLinkVpc) || 
          ($.eventName = DisableVpcClassicLink) || 
          ($.eventName = EnableVpcClassicLink)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: CloudTrailMetrics
        MetricName: VPCChanges
  VPCChangeQuery:
    Type: AWS::Logs::QueryDefinition
    Properties:
      Name: CIS-Alarms/CIS-VPC Has Changed
      LogGroupNames: 
        - !Ref CloudtrailLogGroupName
      QueryString: |-
        fields @timestamp, @message |
          sort @timestamp desc |
          filter eventName in ['AcceptVpcPeeringConnection', 'AttachClassicLinkVpc', 'CreateVpc', 'CreateVpcPeeringConnection', 'DeleteVpc', 'DeleteVpcPeeringConnection', 'DetachClassicLinkVpc', 'DisableVpcClassicLink', 'EnableVpcClassicLink', 'ModifyVpcAttribute', 'RejectVpcPeeringConnection']