Query: Ensure a log metric filter and alarm exist for AWS Management Console sign-in without MFA

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Security Hub recommends that you create a metric filter and alarm console logins that aren't protected by MFA.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
• 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
• 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
• 4.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA
• 4.2 Ensure management console sign-in without MFA is monitored
• 4.2 Ensure management console sign-in without MFA is monitored
• 4.2 Ensure management console sign-in without MFA is monitored
• 4.2 Ensure management console sign-in without MFA is monitored
• Ensure a log metric filter and alarm exist for AWS Management Console sign-in without MFA

SQL