Security group changes alarm remediation

Using Console

Below are console-based steps to set up a CloudWatch alarm for Security Group changes using CloudTrail logs.

1. Ensure CloudTrail Is Enabled and Sending Logs to CloudWatch Logs

In the AWS Management Console, go to CloudTrail.
In the left pane, choose Trails.
Either:
- Use existing trail that already:
  - Logs Management events (Read/Write or at least Write-only).
  - Delivers logs to a CloudWatch Logs log group,
- Or create/configure one:
  1. Click Create trail (or select a trail → Edit).
  2. Under Management events, ensure Write is enabled.
  3. Under CloudWatch Logs, choose Enabled.
  4. Select or create:
    - A CloudWatch log group, and
    - An IAM role for CloudTrail to put logs in CloudWatch Logs.
  5. Save the trail.

2. Create a Metric Filter for Security Group Changes

Go to CloudWatch in the console.
In the left pane, select Logs → Log groups.
Click the log group that CloudTrail is configured to use (e.g., /aws/cloudtrail/logs).
Select the Metric filters tab.
Click Create metric filter.

Under Filter pattern, paste:

{($.eventName = AuthorizeSecurityGroupIngress) ||
 ($.eventName = AuthorizeSecurityGroupEgress)  ||
 ($.eventName = RevokeSecurityGroupIngress)    ||
 ($.eventName = RevokeSecurityGroupEgress)     ||
 ($.eventName = CreateSecurityGroup)           ||
 ($.eventName = DeleteSecurityGroup)           ||
 ($.eventName = UpdateSecurityGroupRuleDescriptionsIngress) ||
 ($.eventName = UpdateSecurityGroupRuleDescriptionsEgress)}

Click Next.
For Metric name, enter something like: SecurityGroupChangeCount.
For Metric namespace, use something like: CIS/SecurityGroup.
For Metric value, enter: 1.
Leave Default value empty or 0 (optional).
Click Next, then Create metric filter.

3. Create a CloudWatch Alarm for the Metric

Still in CloudWatch, go to Alarms → All alarms.
Click Create alarm.
Click Select metric.
Navigate to the namespace you created: CIS → SecurityGroup → Metrics with no dimensions (or whatever you named it).
Select the metric SecurityGroupChangeCount and click Next.

4. Configure Alarm Threshold

Under Conditions:
- Statistic: Sum.
- Period: e.g., 5 minutes.
- Threshold type: Static.
- Whenever SecurityGroupChangeCount is: >= 1.
Click Next.

Under Notification:
- Alarm state trigger: In alarm.
- Select an SNS topic (e.g., security-alerts), or click Create new topic:
  - Give it a name, e.g., security-group-changes-topic.
  - Add your email address (or other endpoints) as a subscription.
Click Next.

6. Name and Create the Alarm

Give the alarm a name like: SecurityGroupChangesAlarm.
(Optional) Add a description, e.g., “Alarm on any Security Group change events from CloudTrail”.
Review settings and click Create alarm.

Check your email (or other endpoint) for the SNS subscription confirmation message.
Confirm the subscription so you receive alerts.

This will trigger a CloudWatch alarm any time CloudTrail logs a Security Group change and send a notification via SNS.

Using CLI

Below is one straightforward way to do this entirely via AWS CLI using a CloudWatch Logs metric filter on CloudTrail logs, plus a CloudWatch alarm.Assumptions (adjust as needed):

You already have a CloudTrail trail that logs to a CloudWatch Logs log group.
Log group name: CloudTrail/DefaultLogGroup
Region: us-east-1
SNS topic for notifications: arn:aws:sns:us-east-1:123456789012:SecurityNotifications

1. Verify your CloudTrail is sending logs to CloudWatch Logs

aws cloudtrail describe-trails \
  --query "trailList[].{Name:Name,LogGroupArn:CloudWatchLogsLogGroupArn}" \
  --region us-east-1

If CloudWatchLogsLogGroupArn is empty, you must configure CloudTrail to send to a log group first (either via console or update-trail + put-event-selectors). Once CloudTrail is delivering events to a log group, use that log group name in the steps below.

2. Create the CloudWatch Logs metric filter

Replace the log group name as needed.

LOG_GROUP_NAME="CloudTrail/DefaultLogGroup"
METRIC_NAME="SecurityGroupChanges"
METRIC_NAMESPACE="CloudTrailMetrics"

aws logs put-metric-filter \
  --log-group-name "$LOG_GROUP_NAME" \
  --filter-name "SecurityGroupChanges" \
  --filter-pattern '{ ($.eventName = AuthorizeSecurityGroupIngress) || 
                      ($.eventName = AuthorizeSecurityGroupEgress)  || 
                      ($.eventName = RevokeSecurityGroupIngress)    || 
                      ($.eventName = RevokeSecurityGroupEgress)     || 
                      ($.eventName = CreateSecurityGroup)           || 
                      ($.eventName = DeleteSecurityGroup) }' \
  --metric-transformations \
      metricName="$METRIC_NAME",metricNamespace="$METRIC_NAMESPACE",metricValue=1

This creates a metric that increments whenever a security group is created, deleted, or its rules are changed.

3. Create the CloudWatch alarm on that metric

SNS_TOPIC_ARN="arn:aws:sns:us-east-1:123456789012:SecurityNotifications"
ALARM_NAME="SecurityGroupChangesAlarm"
REGION="us-east-1"

aws cloudwatch put-metric-alarm \
  --alarm-name "$ALARM_NAME" \
  --alarm-description "Alarm when security group configurations change." \
  --metric-name "$METRIC_NAME" \
  --namespace "$METRIC_NAMESPACE" \
  --statistic Sum \
  --period 300 \
  --evaluation-periods 1 \
  --threshold 1 \
  --comparison-operator GreaterThanOrEqualToThreshold \
  --treat-missing-data notBreaching \
  --alarm-actions "$SNS_TOPIC_ARN" \
  --region "$REGION"

This alarm will go into ALARM state (and notify via SNS) if at least one security group change event is logged in the last 5 minutes.

4. (Optional) Test the setup

Perform an action like adding a rule to a security group:

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp \
  --port 443 \
  --cidr 1.2.3.4/32 \
  --region us-east-1

Within a few minutes, the metric should increment and the alarm should trigger.

Using Python

Below are the steps and sample Python (boto3) code to enable an alarm on Security Group changes using CloudWatch in AWS.

Overview

To alarm on Security Group changes, you typically:

Ensure CloudTrail is logging management events for EC2 (Security Groups) and sending logs to CloudWatch Logs.
Create a CloudWatch Logs metric filter on those CloudTrail events.
Create a CloudWatch alarm on that metric.

1. Prerequisites

boto3 installed:
pip install boto3
AWS credentials configured (via environment vars, ~/.aws/credentials, or IAM role).
An existing CloudTrail that:
- Logs management events.
- Delivers to a CloudWatch Logs log group (you need that log group name).

Let’s assume:

Region: us-east-1
CloudWatch Logs group: /aws/cloudtrail/security
Metric namespace: SecurityGroupMonitoring
Metric name: SecurityGroupChanges
Alarm name: SecurityGroupChangesAlarm
Notification via SNS topic ARN: arn:aws:sns:us-east-1:123456789012:secgroup-alerts

2. Ensure CloudTrail is Sending to CloudWatch Logs (Python)

If you already have this set up, you can skip this step.

import boto3

region = "us-east-1"
logs_group_name = "/aws/cloudtrail/security"
trail_name = "org-or-account-cloudtrail"  # change as needed

logs = boto3.client("logs", region_name=region)
ct = boto3.client("cloudtrail", region_name=region)

# 1) Create CloudWatch Logs group if it doesn't exist
try:
    logs.create_log_group(logGroupName=logs_group_name)
except logs.exceptions.ResourceAlreadyExistsException:
    pass

# 2) Configure / update CloudTrail to send logs to CloudWatch Logs
ct.update_trail(
    Name=trail_name,
    CloudWatchLogsLogGroupArn=f"arn:aws:logs:{region}:123456789012:log-group:{logs_group_name}",
    CloudWatchLogsRoleArn="arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role",
)

You must have an IAM role (CloudTrail_CloudWatchLogs_Role) with the appropriate trust policy for CloudTrail and permissions to write to the log group.

3. Create CloudWatch Logs Metric Filter for Security Group Changes

Target CloudTrail events for Security Groups, e.g.:

AuthorizeSecurityGroupIngress
AuthorizeSecurityGroupEgress
RevokeSecurityGroupIngress
RevokeSecurityGroupEgress
CreateSecurityGroup
DeleteSecurityGroup
UpdateSecurityGroupRuleDescriptionsIngress
UpdateSecurityGroupRuleDescriptionsEgress

Filter pattern example:

{ ($.eventName = "AuthorizeSecurityGroupIngress") ||
  ($.eventName = "AuthorizeSecurityGroupEgress") ||
  ($.eventName = "RevokeSecurityGroupIngress") ||
  ($.eventName = "RevokeSecurityGroupEgress") ||
  ($.eventName = "CreateSecurityGroup") ||
  ($.eventName = "DeleteSecurityGroup") ||
  ($.eventName = "UpdateSecurityGroupRuleDescriptionsIngress") ||
  ($.eventName = "UpdateSecurityGroupRuleDescriptionsEgress") }

Python to create the metric filter:

import boto3

region = "us-east-1"
logs_group_name = "/aws/cloudtrail/security"
metric_namespace = "SecurityGroupMonitoring"
metric_name = "SecurityGroupChanges"
metric_filter_name = "SecurityGroupChangesFilter"

logs = boto3.client("logs", region_name=region)

filter_pattern = (
    '{ ($.eventName = "AuthorizeSecurityGroupIngress") || '
    '($.eventName = "AuthorizeSecurityGroupEgress") || '
    '($.eventName = "RevokeSecurityGroupIngress") || '
    '($.eventName = "RevokeSecurityGroupEgress") || '
    '($.eventName = "CreateSecurityGroup") || '
    '($.eventName = "DeleteSecurityGroup") || '
    '($.eventName = "UpdateSecurityGroupRuleDescriptionsIngress") || '
    '($.eventName = "UpdateSecurityGroupRuleDescriptionsEgress") }'
)

logs.put_metric_filter(
    logGroupName=logs_group_name,
    filterName=metric_filter_name,
    filterPattern=filter_pattern,
    metricTransformations=[
        {
            "metricName": metric_name,
            "metricNamespace": metric_namespace,
            "metricValue": "1"
        }
    ]
)

This will emit a metric value of 1 every time a matching event occurs.

4. Create a CloudWatch Alarm on That Metric

For example, trigger an alarm if ≥ 1 change occurs in a 5‑minute period.

import boto3

region = "us-east-1"
metric_namespace = "SecurityGroupMonitoring"
metric_name = "SecurityGroupChanges"
alarm_name = "SecurityGroupChangesAlarm"
sns_topic_arn = "arn:aws:sns:us-east-1:123456789012:secgroup-alerts"

cw = boto3.client("cloudwatch", region_name=region)

cw.put_metric_alarm(
    AlarmName=alarm_name,
    AlarmDescription="Alarm when Security Group changes occur",
    Namespace=metric_namespace,
    MetricName=metric_name,
    Statistic="Sum",
    Period=300,  # 5 minutes
    EvaluationPeriods=1,
    Threshold=1,
    ComparisonOperator="GreaterThanOrEqualToThreshold",
    TreatMissingData="notBreaching",
    AlarmActions=[sns_topic_arn],      # actions when ALARM
    OKActions=[sns_topic_arn],         # optional: notify when OK
    Dimensions=[],                     # none; metric is global in namespace
)

5. Validation

Make a small SG change (e.g., add/remove a rule).
Wait a few minutes.
In CloudWatch console:
- Check the custom metric SecurityGroupMonitoring / SecurityGroupChanges.
- Confirm it registers data points.
- Confirm SecurityGroupChangesAlarm changes state to ALARM and SNS is triggered.

If you share your exact account/region/log group names and whether CloudTrail → CloudWatch Logs is already configured, I can adapt the code snippets precisely to your environment.

Using Terraform

# CloudTrail log group that already receives CloudTrail events
# Replace EXISTING_CLOUDTRAIL_LOG_GROUP_NAME with your log group name
data "aws_cloudwatch_log_group" "cloudtrail" {
  name = "EXISTING_CLOUDTRAIL_LOG_GROUP_NAME"
}

# Metric filter equivalent to `aws logs put-metric-filter ...`
resource "aws_cloudwatch_log_metric_filter" "security_group_changes" {
  name           = "SecurityGroupChangesFilter"
  log_group_name = data.aws_cloudwatch_log_group.cloudtrail.name

  pattern = "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }"

  metric_transformation {
    name      = "SecurityGroupChangesMetric"
    namespace = "CloudTrailMetrics"
    value     = "1"
  }
}

# SNS topic equivalent to `aws sns create-topic ...`
resource "aws_sns_topic" "security_group_changes" {
  name = "SecurityGroupChangesTopic"
}

# SNS email subscription equivalent to `aws sns subscribe ...`
# Replace ALERT_EMAIL_ADDRESS with a valid email you can confirm
resource "aws_sns_topic_subscription" "security_group_changes_email" {
  topic_arn = aws_sns_topic.security_group_changes.arn
  protocol  = "email"
  endpoint  = "ALERT_EMAIL_ADDRESS"
}

# CloudWatch alarm equivalent to `aws cloudwatch put-metric-alarm ...`
resource "aws_cloudwatch_metric_alarm" "security_group_changes" {
  alarm_name        = "SecurityGroupChangesAlarm"
  alarm_description = "Monitors for AWS Security Group changes"

  namespace  = "CloudTrailMetrics"
  metric_name = "SecurityGroupChangesMetric"
  statistic   = "Sum"
  period      = 300

  threshold          = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  datapoints_to_alarm = 1

  alarm_actions = [
    aws_sns_topic.security_group_changes.arn,
  ]

  treat_missing_data = "notBreaching"
}

This adds new resources and does not force replacement of existing ones, but if a metric filter, SNS topic, or alarm with the same name already exists and is not managed by Terraform, you must either import it or change the names to avoid conflicts.To verify, terraform plan should show 4 resources to add: aws_cloudwatch_log_metric_filter.security_group_changes, aws_sns_topic.security_group_changes, aws_sns_topic_subscription.security_group_changes_email, and aws_cloudwatch_metric_alarm.security_group_changes, with no changes to other resources.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Security group changes alarm remediation

Triage and Remediation

Remediation

1. Ensure CloudTrail Is Enabled and Sending Logs to CloudWatch Logs

2. Create a Metric Filter for Security Group Changes

3. Create a CloudWatch Alarm for the Metric

4. Configure Alarm Threshold

6. Name and Create the Alarm

1. Verify your CloudTrail is sending logs to CloudWatch Logs

2. Create the CloudWatch Logs metric filter

3. Create the CloudWatch alarm on that metric

4. (Optional) Test the setup

Overview

1. Prerequisites

2. Ensure CloudTrail is Sending to CloudWatch Logs (Python)

3. Create CloudWatch Logs Metric Filter for Security Group Changes

4. Create a CloudWatch Alarm on That Metric

5. Validation

​Triage and Remediation

​Remediation

​1. Ensure CloudTrail Is Enabled and Sending Logs to CloudWatch Logs

​2. Create a Metric Filter for Security Group Changes

​3. Create a CloudWatch Alarm for the Metric

​4. Configure Alarm Threshold

​5. Set Notification (SNS) for the Alarm

​6. Name and Create the Alarm

​7. Confirm SNS Subscription

​1. Verify your CloudTrail is sending logs to CloudWatch Logs

​2. Create the CloudWatch Logs metric filter

​3. Create the CloudWatch alarm on that metric

​4. (Optional) Test the setup

​Overview

​1. Prerequisites

​2. Ensure CloudTrail is Sending to CloudWatch Logs (Python)

​3. Create CloudWatch Logs Metric Filter for Security Group Changes

​4. Create a CloudWatch Alarm on That Metric

​5. Validation

Triage and Remediation

Remediation

1. Ensure CloudTrail Is Enabled and Sending Logs to CloudWatch Logs

2. Create a Metric Filter for Security Group Changes

3. Create a CloudWatch Alarm for the Metric

4. Configure Alarm Threshold

5. Set Notification (SNS) for the Alarm

6. Name and Create the Alarm

7. Confirm SNS Subscription

1. Verify your CloudTrail is sending logs to CloudWatch Logs

2. Create the CloudWatch Logs metric filter

3. Create the CloudWatch alarm on that metric

4. (Optional) Test the setup

Overview

1. Prerequisites

2. Ensure CloudTrail is Sending to CloudWatch Logs (Python)

3. Create CloudWatch Logs Metric Filter for Security Group Changes

4. Create a CloudWatch Alarm on That Metric

5. Validation