AWS › AWS CloudTrail & Auditing

How can you set up real time alerting based on specific CloudTrail events using CloudWatch Logs and alarms?

Intermediate

Answer

By configuring a CloudTrail trail to deliver logs to CloudWatch Logs, you can then create metric filters that scan incoming log entries for specific patterns, such as a root user login or a security group being modified, and trigger a CloudWatch alarm the moment that pattern is detected, which can then notify your security team through SNS almost immediately rather than requiring someone to manually review logs after the fact.

aws logs put-metric-filter --log-group-name CloudTrail/Logs --filter-name RootLoginFilter --filter-pattern '{ $.userIdentity.type = "Root" }' --metric-transformations metricName=RootLoginCount,metricNamespace=Security,metricValue=1

Real-world example A security team sets up a CloudWatch alarm based on a CloudTrail metric filter that immediately notifies them through SNS whenever the root account is used to log in, since root account usage is rare and often indicates something worth investigating.

Common follow-ups: What other suspicious activities are commonly monitored using CloudTrail metric filters?;How quickly does an alert typically fire after a matching CloudTrail event occurs?

Monitoring (CloudWatch);Amazon SNS (Simple Notification Service)