Internet Gateway Changes Alarm Should Be Enabled

aws sns create-topic \
  --name internet-gateway-changes-topic

aws sns subscribe \
  --topic-arn IGW_TOPIC_ARN \
  --protocol email \
  --notification-endpoint you@example.com

aws logs put-metric-filter \
  --log-group-name "/aws/cloudtrail/main" \
  --filter-name "InternetGatewayChanges" \
  --filter-pattern '{ ($.eventSource = "ec2.amazonaws.com") && ( ($.eventName = "CreateInternetGateway") || ($.eventName = "AttachInternetGateway") || ($.eventName = "DetachInternetGateway") || ($.eventName = "DeleteInternetGateway") ) }' \
  --metric-transformations \
      metricName="InternetGatewayChangesCount",metricNamespace="Security",metricValue="1"

aws cloudwatch put-metric-alarm \
  --alarm-name "InternetGatewayChangesAlarm" \
  --alarm-description "Alarm when Internet Gateway is created/attached/detached/deleted" \
  --metric-name "InternetGatewayChangesCount" \
  --namespace "Security" \
  --statistic Sum \
  --period 300 \
  --evaluation-periods 1 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --treat-missing-data notBreaching \
  --alarm-actions IGW_TOPIC_ARN \
  --region us-east-1

pip install boto3
aws configure

import boto3
from botocore.exceptions import ClientError

region = "us-east-1"
log_group_name = "/aws/cloudtrail/management"   # <-- CHANGE THIS
metric_filter_name = "InternetGatewayChangesFilter"
metric_namespace = "Security"
metric_name = "InternetGatewayChanges"
alarm_name = "InternetGatewayChangesAlarm"
sns_topic_arn = "arn:aws:sns:us-east-1:123456789012:SecurityAlerts"  # <-- CHANGE THIS

logs_client = boto3.client("logs", region_name=region)
cw_client = boto3.client("cloudwatch", region_name=region)

def create_or_update_metric_filter():
    # Filter pattern for CloudTrail Internet Gateway events
    # Matches events where eventSource is ec2.amazonaws.com and eventName is one of the specified operations.
    filter_pattern = (
        '{ ($.eventSource = "ec2.amazonaws.com") && '
        '($.eventName = "CreateInternetGateway" || '
        '$.eventName = "DeleteInternetGateway" || '
        '$.eventName = "AttachInternetGateway" || '
        '$.eventName = "DetachInternetGateway") }'
    )

    try:
        logs_client.put_metric_filter(
            logGroupName=log_group_name,
            filterName=metric_filter_name,
            filterPattern=filter_pattern,
            metricTransformations=[
                {
                    "metricName": metric_name,
                    "metricNamespace": metric_namespace,
                    "metricValue": "1"
                }
            ]
        )
        print(f"Metric filter '{metric_filter_name}' created/updated.")
    except ClientError as e:
        print("Error creating/updating metric filter:", e)
        raise

def create_or_update_alarm():
    # Alarm if at least 1 matching event occurs in a 5-minute period
    try:
        cw_client.put_metric_alarm(
            AlarmName=alarm_name,
            AlarmDescription="Alarm when Internet Gateway configuration changes occur",
            Namespace=metric_namespace,
            MetricName=metric_name,
            Statistic="Sum",
            Period=300,  # 5 minutes
            EvaluationPeriods=1,
            Threshold=1,
            ComparisonOperator="GreaterThanOrEqualToThreshold",
            TreatMissingData="notBreaching",
            AlarmActions=[sns_topic_arn],
            OKActions=[sns_topic_arn],
            ActionsEnabled=True
        )
        print(f"Alarm '{alarm_name}' created/updated.")
    except ClientError as e:
        print("Error creating/updating alarm:", e)
        raise

if __name__ == "__main__":
    create_or_update_metric_filter()
    create_or_update_alarm()

# Metric filter to publish a metric when Internet Gateway changes occur
resource "aws_cloudwatch_log_metric_filter" "internet_gateway_changes" {
  name           = "internet-gateway-changes-filter"
  log_group_name = "/aws/cloudtrail/LOG_GROUP_NAME" # replace with your CloudTrail log group name

  # Matches Create/Delete/Attach/Detach Internet Gateway API calls
  pattern = <<EOF
{ ($.eventSource = "ec2.amazonaws.com") && 
  (($.eventName = "CreateInternetGateway") || 
   ($.eventName = "DeleteInternetGateway") || 
   ($.eventName = "AttachInternetGateway") || 
   ($.eventName = "DetachInternetGateway")) }
EOF

  metric_transformation {
    name      = "InternetGatewayChanges"
    namespace = "VPC/ChangeMonitoring"  # replace with your desired namespace if needed
    value     = "1"
  }
}

# CloudWatch alarm on the Internet Gateway changes metric
resource "aws_cloudwatch_metric_alarm" "internet_gateway_changes_alarm" {
  alarm_name          = "internet-gateway-changes-alarm"
  alarm_description   = "Alarm when VPC Internet Gateway configuration changes are detected"
  namespace           = aws_cloudwatch_log_metric_filter.internet_gateway_changes.metric_transformation[0].namespace
  metric_name         = aws_cloudwatch_log_metric_filter.internet_gateway_changes.metric_transformation[0].name
  statistic           = "Sum"
  period              = 300
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"

  treat_missing_data = "notBreaching"

  alarm_actions = [
    "ARN_OF_SNS_TOPIC_OR_OTHER_ACTION", # replace with your SNS topic ARN or other action
  ]

  dimensions = {
    # Add dimensions here only if your metric filter sets them; otherwise omit this block
  }
}