Skip to content

Commit 23e3ea4

Browse files
puchy22HugoPBrito
puchy22
and
HugoPBrito
authored
chore(aws): enhance metadata for cloudwatch service (#8848)
Co-authored-by: HugoPBrito <hugopbrit@gmail.com> Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
1 parent f9afb50 commit 23e3ea4

File tree

23 files changed

+488
-270
lines changed

23 files changed

+488
-270
lines changed

‎prowler/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
1616
- Update AWS DRS service metadata to new format [(#8870)](https://github.com/prowler-cloud/prowler/pull/8870)
1717
- C5 compliance framework for Azure provider [(#9081)](https://github.com/prowler-cloud/prowler/pull/9081)
1818
- Update AWS DynamoDB service metadata to new format [(#8871)](https://github.com/prowler-cloud/prowler/pull/8871)
19+
- Update AWS CloudWatch service metadata to new format [(#8848)](https://github.com/prowler-cloud/prowler/pull/8848)
1920
- Update AWS EMR service metadata to new format [(#9002)](https://github.com/prowler-cloud/prowler/pull/9002)
2021
- Update AWS EKS service metadata to new format [(#8890)](https://github.com/prowler-cloud/prowler/pull/8890)
2122
- Update AWS ElastiCache service metadata to new format [(#8933)](https://github.com/prowler-cloud/prowler/pull/8933)

‎prowler/providers/aws/services/cloudwatch/cloudwatch_alarm_actions_alarm_state_configured/cloudwatch_alarm_actions_alarm_state_configured.metadata.json‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,42 @@
11
{
22
"Provider": "aws",
33
"CheckID": "cloudwatch_alarm_actions_alarm_state_configured",
4-
"CheckTitle": "Check if CloudWatch alarms have specified actions configured for the ALARM state.",
4+
"CheckTitle": "CloudWatch metric alarm has actions configured for the ALARM state",
55
"CheckType": [
66
"Software and Configuration Checks/AWS Security Best Practices"
77
],
88
"ServiceName": "cloudwatch",
99
"SubServiceName": "",
10-
"ResourceIdTemplate": "arn:aws:cloudwatch:region:account-id:alarm/alarm-name",
10+
"ResourceIdTemplate": "",
1111
"Severity": "high",
1212
"ResourceType": "AwsCloudWatchAlarm",
13-
"Description": "This control checks whether an Amazon CloudWatch alarm has at least one action configured for the ALARM state. The control fails if the alarm doesn't have an action configured for the ALARM state.",
14-
"Risk": "Without an action configured for the ALARM state, the CloudWatch alarm will not notify you or take any predefined action when a monitored metric goes beyond the defined threshold, potentially delaying responses to critical events.",
15-
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions",
13+
"Description": "Amazon CloudWatch metric alarms are evaluated for **actions** configured for the `ALARM` state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.",
14+
"Risk": "Without an **ALARM action**, threshold breaches trigger no **notification** or **automated response**. This delays detection and containment, risking:\n- Availability: prolonged outages or missed scale-out\n- Integrity/confidentiality: unchecked anomalies enabling tampering or data loss",
15+
"RelatedUrl": "",
16+
"AdditionalURLs": [
17+
"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions",
18+
"https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/cloudwatch/client/put_metric_alarm.html",
19+
"https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm",
20+
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-15",
21+
"https://support.icompaas.com/support/solutions/articles/62000233431-ensure-cloudwatch-alarms-have-specified-actions-configured-for-the-alarm-state",
22+
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatch/cloudwatch-alarm-action.html",
23+
"https://awscli.amazonaws.com/v2/documentation/api/2.0.34/reference/cloudwatch/put-metric-alarm.html"
24+
],
1625
"Remediation": {
1726
"Code": {
18-
"CLI": "aws cloudwatch put-metric-alarm --alarm-name <alarm-name> --alarm-actions <action-arn>",
19-
"NativeIaC": "",
20-
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-15",
21-
"Terraform": ""
27+
"CLI": "aws cloudwatch put-metric-alarm --alarm-name <alarm-name> --metric-name <metric-name> --namespace <namespace> --statistic <statistic> --period <period-seconds> --evaluation-periods <evaluation-periods> --threshold <threshold> --comparison-operator <comparison-operator> --alarm-actions <action-arn>",
28+
"NativeIaC": "```yaml\n# CloudFormation: add an ALARM action to a metric alarm\nResources:\n <example_resource_name>:\n Type: AWS::CloudWatch::Alarm\n Properties:\n AlarmName: <example_resource_name>\n MetricName: <metric-name>\n Namespace: <namespace>\n Statistic: Average\n Period: 60\n EvaluationPeriods: 1\n Threshold: 1\n ComparisonOperator: GreaterThanThreshold\n AlarmActions:\n - <action-arn> # CRITICAL: adds an action for ALARM state so the check passes\n```",
29+
"Other": "1. Open the AWS Console and go to CloudWatch > Alarms\n2. Select the target alarm and choose Edit (or Modify alarm)\n3. In Actions, under When alarm state is ALARM, add an action (e.g., select an SNS topic or other supported action)\n4. Click Save changes",
30+
"Terraform": "```hcl\n# Terraform: add an ALARM action to a metric alarm\nresource \"aws_cloudwatch_metric_alarm\" \"<example_resource_name>\" {\n alarm_name = \"<example_resource_name>\"\n metric_name = \"<metric-name>\"\n namespace = \"<namespace>\"\n statistic = \"Average\"\n period = 60\n evaluation_periods = 1\n threshold = 1\n comparison_operator = \"GreaterThanThreshold\"\n alarm_actions = [\"<action-arn>\"] # CRITICAL: ensures an action is configured for ALARM state\n}\n```"
2231
},
2332
"Recommendation": {
24-
"Text": "Configure your CloudWatch alarms to trigger actions, such as sending notifications via Amazon SNS, when the alarm state changes to ALARM.",
25-
"Url": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatch/cloudwatch-alarm-action.html"
33+
"Text": "Assign at least one **ALARM-state action** per alarm (e.g., notify via SNS or run automated remediation with Lambda/SSM). Keep actions enabled, apply **least privilege** to targets, and regularly test. *For critical metrics*, add redundant paths (EventBridge) for **defense in depth**.",
34+
"Url": "https://hub.prowler.com/check/cloudwatch_alarm_actions_alarm_state_configured"
2635
}
2736
},
28-
"Categories": [],
37+
"Categories": [
38+
"resilience"
39+
],
2940
"DependsOn": [],
3041
"RelatedTo": [],
3142
"Notes": ""

‎prowler/providers/aws/services/cloudwatch/cloudwatch_alarm_actions_enabled/cloudwatch_alarm_actions_enabled.metadata.json‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,40 @@
11
{
22
"Provider": "aws",
33
"CheckID": "cloudwatch_alarm_actions_enabled",
4-
"CheckTitle": "Check if CloudWatch alarms have actions enabled",
4+
"CheckTitle": "CloudWatch metric alarm has actions enabled",
55
"CheckType": [
6-
"Software and Configuration Checks/AWS Security Best Practices"
6+
"Software and Configuration Checks/AWS Security Best Practices",
7+
"Industry and Regulatory Standards/AWS Foundational Security Best Practices",
8+
"TTPs/Defense Evasion"
79
],
810
"ServiceName": "cloudwatch",
911
"SubServiceName": "",
10-
"ResourceIdTemplate": "arn:aws:cloudwatch:region:account-id:alarm/alarm-name",
12+
"ResourceIdTemplate": "",
1113
"Severity": "high",
1214
"ResourceType": "AwsCloudWatchAlarm",
13-
"Description": "Alarm actions automatically alert you when a monitored metric is outside the defined threshold. If the alarm action is deactivated, no actions are run when the alarm changes state, and you won't be alerted to changes in monitored metrics. We recommend activating CloudWatch alarm actions to help you quickly respond to security and operational issues.",
14-
"Risk": "Without active alarm actions, you may not be alerted to security or operational issues, potentially leading to delayed responses and increased risk.",
15-
"RelatedUrl": "https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions",
15+
"Description": "**CloudWatch metric alarms** are evaluated for **alarm actions** activation (`actions_enabled: true`), enabling state changes to invoke configured notifications or automated responses.",
16+
"Risk": "With alarm actions disabled, state changes neither notify nor remediate. Incidents can persist unnoticed, enabling unauthorized activity, configuration drift, or capacity exhaustion. Visibility drops, MTTR rises, and confidentiality, integrity, and availability are all at greater risk.",
17+
"RelatedUrl": "",
18+
"AdditionalURLs": [
19+
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatch/cloudwatch-alarm-action-activated.html",
20+
"https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html#alarms-and-actions",
21+
"https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-17"
22+
],
1623
"Remediation": {
1724
"Code": {
1825
"CLI": "aws cloudwatch enable-alarm-actions --alarm-names <alarm-name>",
19-
"NativeIaC": "",
20-
"Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/cloudwatch-controls.html#cloudwatch-17",
21-
"Terraform": ""
26+
"NativeIaC": "```yaml\nResources:\n <example_resource_name>:\n Type: AWS::CloudWatch::Alarm\n Properties:\n ActionsEnabled: true # FIX: activates alarm actions so the check passes\n ComparisonOperator: GreaterThanThreshold\n EvaluationPeriods: 1\n MetricName: <example_metric_name>\n Namespace: <example_metric_namespace>\n Period: 60\n Statistic: Average\n Threshold: 1\n```",
27+
"Other": "1. Open the CloudWatch console\n2. Go to Alarms > All alarms and select the alarm\n3. Choose Actions > Alarm actions - new > Enable\n4. Confirm to activate actions",
28+
"Terraform": "```hcl\nresource \"aws_cloudwatch_metric_alarm\" \"<example_resource_name>\" {\n alarm_name = \"<example_resource_name>\"\n comparison_operator = \"GreaterThanThreshold\"\n evaluation_periods = 1\n metric_name = \"<example_metric_name>\"\n namespace = \"<example_metric_namespace>\"\n period = 60\n statistic = \"Average\"\n threshold = 1\n\n actions_enabled = true # FIX: activates alarm actions so the check passes\n}\n```"
2229
},
2330
"Recommendation": {
24-
"Text": "Ensure that all CloudWatch alarms have at least one action configured. This can include sending notifications to SNS topics, invoking Lambda functions, or triggering other AWS services.",
25-
"Url": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatch/cloudwatch-alarm-action-activated.html"
31+
"Text": "Enable `actions_enabled` on critical alarms and attach least-privilege actions (SNS, automation) for ALARM and recovery states. Use redundant targets, regularly test notifications, and integrate with incident response. Apply **defense in depth** with complementary detections to ensure timely, reliable alerting.",
32+
"Url": "https://hub.prowler.com/check/cloudwatch_alarm_actions_enabled"
2633
}
2734
},
28-
"Categories": [],
35+
"Categories": [
36+
"resilience"
37+
],
2938
"DependsOn": [],
3039
"RelatedTo": [],
3140
"Notes": ""

‎prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,42 @@
11
{
22
"Provider": "aws",
33
"CheckID": "cloudwatch_changes_to_network_acls_alarm_configured",
4-
"CheckTitle": "Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL).",
4+
"CheckTitle": "CloudWatch log metric filter and alarm exist for Network ACL (NACL) change events",
55
"CheckType": [
6-
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark"
6+
"Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark",
7+
"Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis"
78
],
89
"ServiceName": "cloudwatch",
910
"SubServiceName": "",
10-
"ResourceIdTemplate": "arn:partition:cloudwatch:region:account-id:certificate/resource-id",
11+
"ResourceIdTemplate": "",
1112
"Severity": "medium",
1213
"ResourceType": "AwsCloudWatchAlarm",
13-
"Description": "Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL).",
14-
"Risk": "Monitoring unauthorized API calls will help reveal application errors and may reduce time to detect malicious activity.",
15-
"RelatedUrl": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
14+
"Description": "CloudTrail records for **Network ACL changes** are matched by a CloudWatch Logs metric filter with an associated alarm for events like `CreateNetworkAcl`, `CreateNetworkAclEntry`, `DeleteNetworkAcl`, `DeleteNetworkAclEntry`, `ReplaceNetworkAclEntry`, and `ReplaceNetworkAclAssociation`.",
15+
"Risk": "Absent monitoring of **NACL changes** reduces detection of policy tampering, risking loss of **confidentiality** (opened ingress/egress), degraded network **integrity** (lateral movement, bypassed segmentation), and reduced **availability** (traffic blackholes or lockouts).",
16+
"RelatedUrl": "",
17+
"AdditionalURLs": [
18+
"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
19+
"https://www.clouddefense.ai/compliance-rules/cis-v130/monitoring/cis-v130-4-11",
20+
"https://support.icompaas.com/support/solutions/articles/62000084031-ensure-a-log-metric-filter-and-alarm-exist-for-changes-to-network-access-control-lists-nacl-",
21+
"https://trendmicro.com/cloudoneconformity/knowledge-base/aws/CloudWatchLogs/network-acl-changes-alarm.html",
22+
"https://support.icompaas.com/support/solutions/articles/62000233134-4-11-ensure-network-access-control-list-nacl-changes-are-monitored-manual-"
23+
],
1624
"Remediation": {
1725
"Code": {
1826
"CLI": "",
19-
"NativeIaC": "",
20-
"Other": "https://docs.prowler.com/checks/aws/monitoring-policies/monitoring_11",
21-
"Terraform": "https://docs.prowler.com/checks/aws/monitoring-policies/monitoring_11#fix---buildtime"
27+
"NativeIaC": "```yaml\n# CloudFormation to alert on NACL changes\nResources:\n MetricFilter:\n Type: AWS::Logs::MetricFilter\n Properties:\n LogGroupName: \"<example_resource_name>\" # CRITICAL: CloudTrail log group to monitor\n FilterPattern: '{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }' # CRITICAL: detects NACL changes\n MetricTransformations:\n - MetricValue: \"1\"\n MetricNamespace: \"CISBenchmark\"\n MetricName: \"nacl_changes\"\n\n NaclChangesAlarm:\n Type: AWS::CloudWatch::Alarm\n Properties:\n AlarmName: \"nacl_changes\"\n ComparisonOperator: GreaterThanOrEqualToThreshold\n EvaluationPeriods: 1\n MetricName: \"nacl_changes\" # CRITICAL: alarm targets the metric from the filter\n Namespace: \"CISBenchmark\"\n Period: 300\n Statistic: Sum\n Threshold: 1\n```",
28+
"Other": "1. In the AWS Console, go to CloudWatch > Log groups and open the CloudTrail log group\n2. Metric filters tab > Create metric filter\n3. Set Filter pattern to:\n { ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }\n4. Next > Filter name: nacl_changes; Metric namespace: CISBenchmark; Metric name: nacl_changes; Metric value: 1 > Create metric filter\n5. Select the new metric filter > Create alarm\n6. Set Statistic: Sum, Period: 5 minutes, Threshold type: Static, Condition: Greater/Equal, Threshold: 1\n7. Next through actions (optional) > Name: nacl_changes > Create alarm",
29+
"Terraform": "```hcl\n# CloudWatch metric filter and alarm for NACL changes\nresource \"aws_cloudwatch_log_metric_filter\" \"nacl\" {\n name = \"nacl_changes\"\n log_group_name = \"<example_resource_name>\" # CloudTrail log group\n pattern = \"{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }\" # CRITICAL: detects NACL changes\n\n metric_transformation {\n name = \"nacl_changes\"\n namespace = \"CISBenchmark\"\n value = \"1\"\n }\n}\n\nresource \"aws_cloudwatch_metric_alarm\" \"nacl\" {\n alarm_name = \"nacl_changes\"\n comparison_operator = \"GreaterThanOrEqualToThreshold\"\n evaluation_periods = 1\n metric_name = \"nacl_changes\" # CRITICAL: alarm targets the metric from the filter\n namespace = \"CISBenchmark\"\n period = 300\n statistic = \"Sum\"\n threshold = 1\n}\n```"
2230
},
2331
"Recommendation": {
24-
"Text": "It is recommended that a metric filter and alarm be established for unauthorized requests.",
25-
"Url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html"
32+
"Text": "Implement a CloudWatch Logs metric filter and alarm for NACL change events from CloudTrail and route alerts to responders. Enforce **least privilege** on NACL management, require **change control**, and use **defense in depth** with configuration monitoring and flow logs to validate and monitor network posture.",
33+
"Url": "https://hub.prowler.com/check/cloudwatch_changes_to_network_acls_alarm_configured"
2634
}
2735
},
28-
"Categories": [],
36+
"Categories": [
37+
"logging",
38+
"threat-detection"
39+
],
2940
"DependsOn": [],
3041
"RelatedTo": [],
3142
"Notes": "Logging and Monitoring"

0 commit comments

Comments
 (0)