Skip to content

Commit 7743c14

Browse files
eddalmond1eddalmond1
authored
Merge pull request #136 from NHSDigital/feature/eja-eli-267-create-cloudwatch-metrics
eli-267 creating cloudwatch metrics, which we can use to monitor and create alerts for
2 parents fd6f76a + b78381a commit 7743c14

File tree

1 file changed

+132
-0
lines changed

1 file changed

+132
-0
lines changed

‎infrastructure/stacks/api-layer/cloudwatch_metrics.tf‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
locals {
2+
cloudtrail_custom_metrics = [
3+
{
4+
name = "UnauthorizedApiCalls"
5+
namespace = "security"
6+
filter = "{($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")}"
7+
log_group_name = "NHSDAudit_trail_log_group"
8+
},
9+
{
10+
name = "ConsoleAuthenticationFailures"
11+
namespace = "security"
12+
filter = "{($.eventName=ConsoleLogin) && ($.errorMessage=\"Failed authentication\")}"
13+
log_group_name = "NHSDAudit_trail_log_group"
14+
},
15+
{
16+
name = "CloudTrailConfigChanges"
17+
namespace = "security"
18+
filter = "{($.eventName=CreateTrail) || ($.eventName=UpdateTrail) || ($.eventName=DeleteTrail) || ($.eventName=StartLogging) || ($.eventName=StopLogging)}"
19+
log_group_name = "NHSDAudit_trail_log_group"
20+
},
21+
{
22+
name = "VPCChanges"
23+
namespace = "security"
24+
filter = "{($.eventName=CreateVpc) || ($.eventName=DeleteVpc) || ($.eventName=ModifyVpcAttribute) || ($.eventName=AcceptVpcPeeringConnection) || ($.eventName=CreateVpcPeeringConnection) || ($.eventName=DeleteVpcPeeringConnection) || ($.eventName=RejectVpcPeeringConnection) || ($.eventName=AttachClassicLinkVpc) || ($.eventName=DetachClassicLinkVpc) || ($.eventName=DisableVpcClassicLink) || ($.eventName=EnableVpcClassicLink)}"
25+
log_group_name = "NHSDAudit_trail_log_group"
26+
},
27+
{
28+
name = "AWSConfigChanges"
29+
namespace = "security"
30+
filter = "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}"
31+
log_group_name = "NHSDAudit_trail_log_group"
32+
},
33+
{
34+
name = "ModificationOfCMKs"
35+
namespace = "security"
36+
filter = "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}"
37+
log_group_name = "NHSDAudit_trail_log_group"
38+
},
39+
{
40+
name = "UnsuccessfulSwitchRole"
41+
namespace = "security"
42+
filter = "{ ( $.eventName = SwitchRole && $.responseElements.SwitchRole = Failure ) }"
43+
log_group_name = "NHSDAudit_trail_log_group"
44+
},
45+
{
46+
name = "ConsoleLoginNoMFA"
47+
namespace = "security"
48+
filter = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") && ($.userIdentity.type = \"IAMUser\") && ($.responseElements.ConsoleLogin = \"Success\") }"
49+
log_group_name = "NHSDAudit_trail_log_group"
50+
},
51+
{
52+
name = "RootAccountUsage"
53+
namespace = "security"
54+
filter = "{$.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !=\"AwsServiceEvent\"}"
55+
log_group_name = "NHSDAudit_trail_log_group"
56+
},
57+
{
58+
name = "SecurityGroupChange"
59+
namespace = "security"
60+
filter = "{($.eventName=AuthorizeSecurityGroupIngress) || ($.eventName=AuthorizeSecurityGroupEgress) || ($.eventName=RevokeSecurityGroupIngress) || ($.eventName=RevokeSecurityGroupEgress) || ($.eventName=CreateSecurityGroup) || ($.eventName=DeleteSecurityGroup)}"
61+
log_group_name = "NHSDAudit_trail_log_group"
62+
},
63+
{
64+
name = "RouteTableChanges"
65+
namespace = "security"
66+
filter = "{($.eventSource=ec2.amazonaws.com) && (($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable))}"
67+
log_group_name = "NHSDAudit_trail_log_group"
68+
},
69+
{
70+
name = "IAMPolicyChanges"
71+
namespace = "security"
72+
filter = "{($.eventSource=iam.amazonaws.com) && (($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy))}"
73+
log_group_name = "NHSDAudit_trail_log_group"
74+
},
75+
{
76+
name = "s3BucketPolicyChanges"
77+
namespace = "security"
78+
filter = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}"
79+
log_group_name = "NHSDAudit_trail_log_group"
80+
},
81+
{
82+
name = "ChangesToNetworkGateways"
83+
namespace = "security"
84+
filter = "{($.eventName=CreateCustomerGateway) || ($.eventName=DeleteCustomerGateway) || ($.eventName=AttachInternetGateway) || ($.eventName=CreateInternetGateway) || ($.eventName=DeleteInternetGateway) || ($.eventName=DetachInternetGateway)}"
85+
log_group_name = "NHSDAudit_trail_log_group"
86+
},
87+
{
88+
name = "ChangesToNACLs"
89+
namespace = "security"
90+
filter = "{($.eventName=CreateNetworkAcl) || ($.eventName=CreateNetworkAclEntry) || ($.eventName=DeleteNetworkAcl) || ($.eventName=DeleteNetworkAclEntry) || ($.eventName=ReplaceNetworkAclEntry) || ($.eventName=ReplaceNetworkAclAssociation)}"
91+
log_group_name = "NHSDAudit_trail_log_group"
92+
},
93+
{
94+
name = "KMSKeyPolicyChanges"
95+
namespace = "security"
96+
filter = "{($.eventSource=kms.amazonaws.com) && (($.eventName=PutKeyPolicy) || ($.eventName=DeleteKeyPolicy))}"
97+
log_group_name = "NHSDAudit_trail_log_group"
98+
},
99+
{
100+
name = "s3PublicAccessChanges"
101+
namespace = "security"
102+
filter = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutObjectAcl))}"
103+
log_group_name = "NHSDAudit_trail_log_group"
104+
},
105+
{
106+
name = "CloudWatchAlarmChanges"
107+
namespace = "security"
108+
filter = "{($.eventSource=cloudwatch.amazonaws.com) && (($.eventName=PutMetricAlarm) || ($.eventName=DeleteAlarms) || ($.eventName=SetAlarmState))}"
109+
log_group_name = "NHSDAudit_trail_log_group"
110+
},
111+
{
112+
name = "LambdaFunctionChanges"
113+
namespace = "security"
114+
filter = "{($.eventSource=lambda.amazonaws.com) && (($.eventName=CreateFunction20150331) || ($.eventName=DeleteFunction20150331) || ($.eventName=UpdateFunctionCode20150331) || ($.eventName=UpdateFunctionConfiguration20150331))}"
115+
log_group_name = "NHSDAudit_trail_log_group"
116+
},
117+
]
118+
}
119+
120+
resource "aws_cloudwatch_log_metric_filter" "cloudtrail_custom_metrics" {
121+
for_each = { for metric in local.cloudtrail_custom_metrics : metric.name => metric }
122+
123+
name = each.value.name
124+
log_group_name = each.value.log_group_name
125+
pattern = each.value.filter
126+
127+
metric_transformation {
128+
name = each.value.name
129+
namespace = each.value.namespace
130+
value = "1"
131+
}
132+
}

0 commit comments

Comments
 (0)