EventBridge Global Endpoints Replication Should Be Enabled

Using Console

To remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch in the AWS console, follow these step-by-step instructions:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and log in using your credentials.
Navigate to CloudWatch: Click on the “Services” dropdown menu at the top of the page and select “CloudWatch” under the Management & Governance section.
Go to EventBridge: In the CloudWatch dashboard, navigate to the left-hand side menu and click on “EventBridge” under the Events section.
Select Global Endpoints: In the EventBridge dashboard, click on the “Global Endpoints” tab on the left-hand side menu.
Enable Replication: Locate the option for “Replication” and ensure that it is enabled. If it is not enabled, click on the “Edit” button or the toggle switch to enable replication for global endpoints.
Save Changes: After enabling replication, make sure to save the changes by clicking on the “Save” or “Update” button, typically located at the bottom or top of the page.
Verify Configuration: Double-check that the replication for global endpoints is now enabled by reviewing the settings and ensuring that the changes have been successfully saved.

By following these steps, you should be able to remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch in the AWS console.

Using CLI

To remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch using AWS CLI, follow these steps:

Open your terminal or command prompt.
Run the following AWS CLI command to enable EventBridge Global Endpoints Replication for AWS CloudWatch:

aws events put-replication-configuration --region <region-name> --destination <destination-arn> --event-bus-name <event-bus-name>

Replace the placeholders:

<region-name>: The AWS region where the EventBridge event bus is located.
<destination-arn>: The Amazon Resource Name (ARN) of the destination where the events will be replicated.
<event-bus-name>: The name of the EventBridge event bus for AWS CloudWatch.

Verify the replication configuration by running the following AWS CLI command:

aws events describe-replication-configuration --region <region-name> --event-bus-name <event-bus-name>

Replace the placeholders:

<region-name>: The AWS region where the EventBridge event bus is located.
<event-bus-name>: The name of the EventBridge event bus for AWS CloudWatch.

Ensure that the output of the describe-replication-configuration command shows that the replication configuration is successfully enabled for the specified event bus.

By following these steps, you can remediate the misconfiguration of EventBridge Global Endpoints Replication not being enabled for AWS CloudWatch using AWS CLI.

Using Python

To remediate the misconfiguration of EventBridge global endpoints replication not being enabled in AWS CloudWatch using Python, follow these steps:

Import the Boto3 library to interact with AWS services.

import boto3

Initialize the CloudWatch client using Boto3.

cloudwatch_client = boto3.client('cloudwatch')

Enable EventBridge global endpoints replication for CloudWatch using the following API call:

response = cloudwatch_client.enable_insight_rules()

Verify the response to ensure that the global endpoints replication has been successfully enabled.

if response['ResponseMetadata']['HTTPStatusCode'] == 200:
    print("EventBridge global endpoints replication has been successfully enabled for CloudWatch.")
else:
    print("Failed to enable EventBridge global endpoints replication for CloudWatch.")

Run the Python script to execute the remediation steps.

By following these steps, you can remediate the misconfiguration of EventBridge global endpoints replication not being enabled in AWS CloudWatch using Python.

Using Terraform

resource "aws_cloudwatch_event_endpoint" "GLOBAL_ENDPOINT" {
  name = "GLOBAL_ENDPOINT_NAME" # replace with your global endpoint name

  # Preserve your existing routing configuration
  routing_config {
    failover_config {
      primary {
        health_check = "PRIMARY_HEALTH_CHECK_ARN" # replace with your existing value
      }

      secondary {
        route = "SECONDARY_ROUTE_VALUE" # replace with your existing value
      }
    }
  }

  # Preserve your existing event buses
  event_buses {
    event_bus_arn = "PRIMARY_EVENT_BUS_ARN" # replace with your existing value
  }

  event_buses {
    event_bus_arn = "SECONDARY_EVENT_BUS_ARN" # replace with your existing value
  }

  # Preserve your existing IAM role
  role_arn = "ENDPOINT_ROLE_ARN" # replace with your existing IAM role ARN

  # FIX: enable event replication for the global endpoint
  replication_config {
    state = "ENABLED"
  }
}

Changing only replication_config.state from DISABLED (or unset) to ENABLED updates the existing global endpoint in place and should not force replacement.To verify, terraform plan should show an in-place update (~) to aws_cloudwatch_event_endpoint.GLOBAL_ENDPOINT with replication_config.state changing to "ENABLED" and all other attributes unchanged.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EventBridge Global Endpoints Replication Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: