Use the Conformity Knowledge Base AI to help improve your Cloud Posture

AWS Organizations Changes Alarm

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: CWL-016

Ensure that there is an Amazon CloudWatch alarm implemented within your AWS Master account that is triggered each time an administrator-specific action occurs within your AWS Organizations.

This rule can help you with the following compliance standards:

  • PCI
  • APRA
  • MAS
  • NIST4

For further details on compliance standards supported by Conformity, see here.

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Security

Using Amazon CloudWatch alarms to detect administrator-specific changes such as create organization, delete organization, create new accounts within an organization or remove a member account from an organization is considered best practice and can help you prevent any unwanted, accidental or intentional modifications that may lead to unauthorized access or other security breaches. This monitoring technique helps you to ensure that any unexpected changes performed within your AWS Organizations can be investigated and any unwanted changes can be rolled back.


Note 1: Enabling CloudWatch alarms to detect changes performed within your AWS organization is required only for the Master account available in the organization.
Note 2: For this rule, Cloud Conformity assumes that the CloudTrail service is already enabled to stream event log data to CloudWatch within your AWS account, otherwise see this rule to enable AWS Cloudtrail – CloudWatch integration.
Note 3: Currently, AWS Organizations is hosted in only the US East (N. Virginia) Region even though it is available globally. To perform the steps, you must configure the AWS Management Console/CLI to use that region.


Audit

To determine if there are any CloudWatch alarms set up to monitor your Amazon Organizations changes, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Cloudwatch dashboard at https://console.aws.amazon.com/cloudwatch/.

03 In the left navigation panel select Alarms.

04 Open the dashboard Show/Hide Columns dialog box by clicking the configuration icon:

configuration icon

then select the Metric Name checkbox.

05 In the Metric Name column, verify each alarm available for the OrganizationEvents metric. If the OrganizationEvents metric is not used by any of your existing alarms, the changes made within your Amazon Organizations are not currently monitored using AWS CloudWatch alarms.

Using AWS CLI

01 Run describe-alarms-for-metric command (OSX/Linux/UNIX) to list all AWS CloudWatch alarms that are currently associated with the OrganizationEvents metric, available in the selected region:

aws cloudwatch describe-alarms-for-metric
	--region us-east-1
	--metric-name OrganizationEvents
	--namespace CloudTrailMetrics

02 The command output should return an array with the requested CloudWatch alarm(s) metadata:

{
    "MetricAlarms": []
}

03 If the command output returns an empty array, i.e. [ ], for the value of the MetricAlarms property (as shown in the example above), there are no AWS CloudWatch alarms implemented to detect the changes made within your Amazon Organizations.

Remediation / Resolution

Step 1: Create a Simple Notification Service (SNS) topic and the necessary subscription to send notifications whenever the appropriate AWS CloudWatch alarm is triggered:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to SNS dashboard at https://console.aws.amazon.com/sns/v2/.

03 In the navigation panel, select Topics and click the Create new topic button.

04 In the Create new topic dialog box, enter a name and a display name for your topic then click Create Topic.

05 Open the newly created SNS topic configuration page by clicking on its Amazon Resource Name (ARN):

Amazon Resource Name

06 Under Subscription section click Create Subscription.

07 Select Email as subscription protocol from the Protocol dropdown list.

08 In the Endpoint box, enter the email address where you want to receive the CloudWatch alarm notifications then click Create Subscription to create the required subscription.

09 Use your preferred email client application to open the message received from AWS Notifications, then click on the appropriate link to confirm your new email subscription.

Using AWS CLI

01 Run create-topic command (OSX/Linux/UNIX) to create a new SNS topic for sending email notifications whenever the necessary AWS CloudWatch alarm is triggered:

aws sns create-topic
	--name OrganizationChangesAlarmSNSTopic

02 The command output should return the Amazon Resource Name (ARN) for the newly created AWS SNS topic:

{
"TopicArn":"arn:aws:sns:us-east-1:12345678901:OrganizationChangesAlarmSNSTopic"
}

03 Run subscribe command (OSX/Linux/UNIX) to send the subscription confirmation message to the notification endpoint (i.e. the email address provided):

aws sns subscribe
	--topic-arn arn:aws:sns:us-east-1:123456789012:OrganizationChangesAlarmSNSTopic
	--protocol email
	--notification-endpoint no-reply@cloudconformity.com

04 Run confirm-subscription command (OSX/Linux/UNIX) to confirm the email subscription by validating the token sent to the notification endpoint selected (the command does not produce an output):

aws sns confirm-subscription
	--topic-arn arn:aws:sns:us-east-1:123456789012:OrganizationChangesAlarmSNSTopic
	--token a3d9e15f37fb687f5d51e6e241d7700ae02f7124d8268910b858cb4db727ceeb2474bb937929d3bdd7ce5d0cce19325d036bc858d3c217426bcafa9c501a2cace93b83f1dd3797627467553dc438a8c974119496fc3eff026eaa5d14472ded6f9a5c43aec62d83ef5f49109da71e61ed8

Step 2: Create the necessary metric filter and the CloudWatch alarm that will fire and send email notifications whenever an administrator-specific change is made within your Amazon Organizations:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Cloudwatch dashboard at https://console.aws.amazon.com/cloudwatch/.

03 In the left navigation panel, select Logs.

04 Select the log group created for your CloudTrail trail event logs and click Create Metric Filter button.

05 On the Define Logs Metric Filter page, paste the following pattern inside the Filter Pattern box: { ($.eventSource = organizations.amazonaws.com) && ($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CancelHandshake) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganization) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = EnableAllFeatures) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdateOrganizationalUnit) || ($.eventName = UpdatePolicy) }. This pattern will be used for scanning the AWS CloudTrail logs for administrator-specific event names like “CreateOrganization”, “LeaveOrganization” or “InviteAccountToOrganization”.

06 Review the metric filter configuration details then click Assign Metric.

07 On the Create Metric Filter and Assign a Metric page, perform the following:

  1. In the Filter Name box, enter a unique name for the new filter, e.g. OrganizationsChanges.
  2. In the Metric Namespace box, type CloudTrailMetrics.
  3. In the Metric Name box, type OrganizationsEvents for the metric identifier.
  4. Click Show advanced metric settings to slide down the advanced settings section.
  5. In the Metric Value box, enter 1.

08 Review the details then click Create Filter to generate your new CloudWatch Logs metric filter.

09 On the current page click Create Alarm from the top-right menu.

10 In the Create Alarm dialog box, provide the following information:

  1. Within the Alarm Threshold section, in the Name and Description fields, enter a unique name and a short description for the new CloudWatch alarm.
  2. Under Whenever: <Metric Name>, select >= (greater than or equal to) from the is dropdown list and enter 1 as the threshold value in the box next to the dropdown list to trigger the alarm every time a change involving your AWS Organizations is made.
  3. In the Actions section, click the + Notification button, select State is ALARM from the Whenever this alarm dropdown menu and choose the AWS SNS topic name created at Step 1 from Send notification to.
  4. In the Alarm Preview section, select 5 Minutes from the Period dropdown list and Sum from the Statistic list.
  5. Review the CloudWatch alarm configuration details then click Create Alarm. Once created, the new alarm will be listed on the Alarms page. Once the data is loaded, the State (status) of the new CloudWatch alarm will change from INSUFFICIENT_DATA to OK.

Using AWS CLI

01 Run put-metric-filter command (OSX/Linux/UNIX) to create the necessary CloudWatch metric filter and associate it with the appropriate Amazon CloudTrail log group (the command does not produce an output):

aws logs put-metric-filter
	--region us-east-1
	--log-group-name CloudTrail/CloudWatchLogGroup
	--filter-name OrganizationsChanges
	--filter-pattern '{ ($.eventSource = organizations.amazonaws.com) && ($.eventName = AcceptHandshake) || ($.eventName = AttachPolicy) || ($.eventName = CancelHandshake) || ($.eventName = CreateAccount) || ($.eventName = CreateOrganization) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreatePolicy) || ($.eventName = DeclineHandshake) || ($.eventName = DeleteOrganization) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeletePolicy) || ($.eventName = EnableAllFeatures) || ($.eventName = EnablePolicyType) || ($.eventName = InviteAccountToOrganization) || ($.eventName = LeaveOrganization) || ($.eventName = DetachPolicy) || ($.eventName = DisablePolicyType) || ($.eventName = MoveAccount) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = UpdateOrganizationalUnit) || ($.eventName = UpdatePolicy) }'
	--metric-transformations metricName=OrganizationsEvents,metricNamespace=CloudTrailMetrics,metricValue=1

02 Run put-metric-alarm command (OSX/Linux/UNIX) to create the AWS CloudWatch alarm that will fire whenever an administrator-specific change is made within your Amazon Organizations (if successful, the command does not return an output):

aws cloudwatch put-metric-alarm
	--region us-east-1
	--alarm-name OrganizationsChangesAlarm
	--alarm-description "Triggered by AWS Organizations events."
	--metric-name OrganizationsEvents
	--namespace CloudTrailMetrics
	--statistic Sum
	--comparison-operator GreaterThanOrEqualToThreshold
	--evaluation-periods 1
	--period 300
	--threshold 1
	--actions-enabled
	--alarm-actions arn:aws:sns:us-east-1:123456789012:OrganizationChangesAlarmSNSTopic

03 Run subscribe command (OSX/Linux/UNIX) to send the subscription confirmation message to the notification endpoint (i.e. the email address provided):

aws sns subscribe
	--topic-arn arn:aws:sns:us-east-1:123456789012:OrganizationChangesAlarmSNSTopic
	--protocol email
	--notification-endpoint no-reply@cloudconformity.com

References

Publication date Jul 19, 2017