feat: add Control Tower log group metric filters

[patheard]

Summary

Add CloudWatch metric filters to the Control Tower log group. These are the first step towards addressing the Security Hub findings that are failing because they don't exist.

Once the filters have been created, we can determine which can have alarms created and which would cause too much noise.

Related

• https://github.com/cds-snc/platform-core-services/issues/471
• Security Hub > Amazon CloudWatch controls

[github-actions]

Plan for org_account/organization

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 14 to add, 0 to change, 0 to destroy

Show summary

CHANGE	NAME
add	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["cloudtrail_setting_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["config_settings_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["console_sign_in_failure"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["console_sign_in_without_mfa"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["iam_policy_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["kms_scheduled_delete"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["nacl_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["network_gateway_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["s3_bucket_policy_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["security_group_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["unauthorized_api_call"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["use_of_root_account"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["vpc_change"]
	aws_cloudwatch_log_metric_filter.control_tower_metric_filter["vpc_route_table_change"]

Show plan

Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["cloudtrail_setting_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "cloudtrail_setting_change"
      + pattern        = "{($.eventName=CreateTrail) || ($.eventName=UpdateTrail) || ($.eventName=DeleteTrail) || ($.eventName=StartLogging) || ($.eventName=StopLogging)}"

      + metric_transformation {
          + default_value = "0"
          + name          = "cloudtrail_setting_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["config_settings_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "config_settings_change"
      + pattern        = "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}"

      + metric_transformation {
          + default_value = "0"
          + name          = "config_settings_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["console_sign_in_failure"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "console_sign_in_failure"
      + pattern        = "{($.eventName=ConsoleLogin) && ($.errorMessage=\"Failed authentication\")}"

      + metric_transformation {
          + default_value = "0"
          + name          = "console_sign_in_failure"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["console_sign_in_without_mfa"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "console_sign_in_without_mfa"
      + pattern        = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") && ($.userIdentity.type = \"IAMUser\") && ($.responseElements.ConsoleLogin = \"Success\") }"

      + metric_transformation {
          + default_value = "0"
          + name          = "console_sign_in_without_mfa"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["iam_policy_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "iam_policy_change"
      + pattern        = "{($.eventSource=iam.amazonaws.com) && (($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy))}"

      + metric_transformation {
          + default_value = "0"
          + name          = "iam_policy_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["kms_scheduled_delete"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "kms_scheduled_delete"
      + pattern        = "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}"

      + metric_transformation {
          + default_value = "0"
          + name          = "kms_scheduled_delete"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["nacl_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "nacl_change"
      + pattern        = "{($.eventName=CreateNetworkAcl) || ($.eventName=CreateNetworkAclEntry) || ($.eventName=DeleteNetworkAcl) || ($.eventName=DeleteNetworkAclEntry) || ($.eventName=ReplaceNetworkAclEntry) || ($.eventName=ReplaceNetworkAclAssociation)}"

      + metric_transformation {
          + default_value = "0"
          + name          = "nacl_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["network_gateway_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "network_gateway_change"
      + pattern        = "{($.eventName=CreateCustomerGateway) || ($.eventName=DeleteCustomerGateway) || ($.eventName=AttachInternetGateway) || ($.eventName=CreateInternetGateway) || ($.eventName=DeleteInternetGateway) || ($.eventName=DetachInternetGateway)}"

      + metric_transformation {
          + default_value = "0"
          + name          = "network_gateway_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["s3_bucket_policy_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "s3_bucket_policy_change"
      + pattern        = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}"

      + metric_transformation {
          + default_value = "0"
          + name          = "s3_bucket_policy_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["security_group_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "security_group_change"
      + pattern        = "{($.eventName=AuthorizeSecurityGroupIngress) || ($.eventName=AuthorizeSecurityGroupEgress) || ($.eventName=RevokeSecurityGroupIngress) || ($.eventName=RevokeSecurityGroupEgress) || ($.eventName=CreateSecurityGroup) || ($.eventName=DeleteSecurityGroup)}"

      + metric_transformation {
          + default_value = "0"
          + name          = "security_group_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["unauthorized_api_call"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "unauthorized_api_call"
      + pattern        = "{($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")}"

      + metric_transformation {
          + default_value = "0"
          + name          = "unauthorized_api_call"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["use_of_root_account"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "use_of_root_account"
      + pattern        = "{$.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !=\"AwsServiceEvent\"}"

      + metric_transformation {
          + default_value = "0"
          + name          = "use_of_root_account"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["vpc_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "vpc_change"
      + pattern        = "{($.eventName=CreateVpc) || ($.eventName=DeleteVpc) || ($.eventName=ModifyVpcAttribute) || ($.eventName=AcceptVpcPeeringConnection) || ($.eventName=CreateVpcPeeringConnection) || ($.eventName=DeleteVpcPeeringConnection) || ($.eventName=RejectVpcPeeringConnection) || ($.eventName=AttachClassicLinkVpc) || ($.eventName=DetachClassicLinkVpc) || ($.eventName=DisableVpcClassicLink) || ($.eventName=EnableVpcClassicLink)}"

      + metric_transformation {
          + default_value = "0"
          + name          = "vpc_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

  # aws_cloudwatch_log_metric_filter.control_tower_metric_filter["vpc_route_table_change"] will be created
  + resource "aws_cloudwatch_log_metric_filter" "control_tower_metric_filter" {
      + id             = (known after apply)
      + log_group_name = "aws-controltower/CloudTrailLogs"
      + name           = "vpc_route_table_change"
      + pattern        = "{($.eventSource=ec2.amazonaws.com) && (($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable))}"

      + metric_transformation {
          + default_value = "0"
          + name          = "vpc_route_table_change"
          + namespace     = "LogMetrics"
          + unit          = "None"
          + value         = "1"
        }
    }

Plan: 14 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"
Releasing state lock. This may take a few moments...

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.AFT"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.DumpsterFire"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.Production"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.SRETools"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.Sandbox"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.Security"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.Staging"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_organizational_unit.Test"]
WARN - plan.json - main - Missing Common Tags: ["aws_organizations_policy.cds_snc_universal_guardrails"]

26 tests, 17 passed, 9 warnings, 0 failures, 0 exceptions