Cloudwatch alarm for IAM Policies changes doesn't work

Igor 0
Viewed 21

I'm just trying to create fully functional alarm that will change state if there's any IAM Policies changes will be made.

  1. Create an S3 Bucket for Cloudtrail logs.
  2. Create trail in Cloudtrail.
  3. Add Metric filter:

{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}

  1. Create Alarm for this filter by using created Metric and Metricname.

If I attach or detach any policy for any IAM Role - nothing happening.

There's a policies for cloudwatch role:

    "Statement": [
        {
            "Action": [
                "s3:GetBucketAcl",
                "s3:PutObject",
                "cloudtrail:StartLogging",
                "cloudtrail:StopLogging",
                "cloudtrail:Get*",
                "cloudtrail:CreateTrail",
                "cloudtrail:UpdateTrail",
                "iam:CreateServiceLinkedRole",
                "iam:CreateRole",
                "iam:PutRolePolicy",
                "iam:AttachRolePolicy",
                "iam:ListRoles",
                "iam:GetRolePolicy",
                "iam:GetUser",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole"
                "autoscaling:Describe*",
                "cloudwatch:*",
                "logs:*",
                "sns:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Anyone can advise why there's no changes in alarm state?

amazon-cloudwatchlogs amazon-cloudtrail amazon-cloudwatch amazon-iam amazon-web-services
1 Answers

Your Metric filter works fine, and the role is ok (it seems too much, though).

Try to check your filter can detect from your own trail logs by testing on the console.

enter image description here

Check the state of the alarm is OK.

enter image description here

Check the Metrics are found properly.

enter image description here

Note: I think when setting CW alarms, we need to wait a while (several minutes or so). Immediate actions do not work.

shimo0
Related