Query: Ensure a log metric filter and alarm exist for AWS Config configuration changes

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Hub recommends that you create a metric filter and alarm for changes to AWS Config configuration settings. Monitoring these changes helps ensure sustained visibility of configuration items in the account

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
• 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
• 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
• 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes
• 4.9 Ensure AWS Config configuration changes are monitored
• 4.9 Ensure AWS Config configuration changes are monitored
• 4.9 Ensure AWS Config configuration changes are monitored
• 4.9 Ensure AWS Config configuration changes are monitored
• Ensure a log metric filter and alarm exist for AWS Config configuration changes

SQL