Organizations changes alarm remediation

Using Console

Using CLI

The AWS Organizations Changes Alarm is triggered when there are changes made to the AWS Organizations service. To remediate this issue, you can follow the below steps using AWS CLI:

Log in to your AWS account using AWS CLI.
Run the following command to create an SNS topic that will be used to send notifications when the alarm is triggered:

aws sns create-topic --name <topic-name>

Run the following command to create a new CloudWatch alarm:

aws cloudwatch put-metric-alarm --alarm-name <alarm-name> --alarm-description "AWS Organizations Changes Alarm" --metric-name Organizations --namespace AWS/Organizations --statistic Sum --period 300 --evaluation-periods 1 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold --dimensions Name=Operation,Value=All --alarm-actions <sns-topic-arn>

Replace the <alarm-name> with a name of your choice, <sns-topic-arn> with the ARN of the SNS topic created in step 2.

Verify that the alarm has been created successfully by running the following command:

aws cloudwatch describe-alarms --alarm-names <alarm-name>

This should return the details of the alarm that you just created.

Finally, you can test the alarm by making a change to your AWS Organizations service. If the alarm is triggered, you should receive a notification via the SNS topic created in step 2.

By following these steps, you can remediate the AWS Organizations Changes Alarm issue using AWS CLI.

Using Python

The AWS Organizations Changes Alarm is triggered when there are changes made to the AWS Organizations service. To remediate this issue using Python, you can follow these steps:

Create an SNS topic: You can create an SNS topic using the AWS SDK for Python (boto3). This topic will be used to send notifications whenever there is a change in the AWS Organizations service.

import boto3

sns = boto3.client('sns')

response = sns.create_topic(Name='organizations-changes')

topic_arn = response['TopicArn']

Create a CloudWatch Events rule: You can create a CloudWatch Events rule to monitor changes to the AWS Organizations service. This rule will trigger an AWS Lambda function whenever there is a change.

import boto3

events = boto3.client('events')

response = events.put_rule(
    Name='organizations-changes',
    EventPattern='{"source": ["aws.organizations"]}'
)

rule_arn = response['RuleArn']

Create an AWS Lambda function: You can create an AWS Lambda function using the AWS SDK for Python (boto3). This function will be triggered by the CloudWatch Events rule and will send a notification to the SNS topic.

import boto3

lambda_client = boto3.client('lambda')

response = lambda_client.create_function(
    FunctionName='organizations-changes',
    Runtime='python3.7',
    Role='arn:aws:iam::123456789012:role/lambda-role',
    Handler='lambda_function.lambda_handler',
    Code={
        'ZipFile': b'bytes',
    },
    Environment={
        'Variables': {
            'SNS_TOPIC_ARN': topic_arn,
        }
    },
)

function_arn = response['FunctionArn']

Add permissions to the Lambda function: You need to add permissions to the Lambda function to allow it to publish messages to the SNS topic.

import boto3

lambda_client = boto3.client('lambda')

response = lambda_client.add_permission(
    FunctionName='organizations-changes',
    StatementId='sns-publish',
    Action='lambda:InvokeFunction',
    Principal='sns.amazonaws.com',
    SourceArn=topic_arn,
)

Create a CloudWatch alarm: You can create a CloudWatch alarm to monitor the SNS topic. This alarm will be triggered whenever a message is published to the SNS topic.

import boto3

cloudwatch = boto3.client('cloudwatch')

response = cloudwatch.put_metric_alarm(
    AlarmName='organizations-changes',
    AlarmActions=[topic_arn],
    MetricName='NumberOfMessagesPublished',
    Namespace='AWS/SNS',
    Statistic='Sum',
    Period=60,
    EvaluationPeriods=1,
    Threshold=1,
    ComparisonOperator='GreaterThanOrEqualToThreshold',
)

These steps will help you remediate the AWS Organizations Changes Alarm issue using Python.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Organizations changes alarm remediation

Triage and Remediation

Remediation