Query: Ensure a log metric filter and alarm exist for changes to network gateways

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Network gateways are required to send and receive traffic to a destination outside a VPC. Security Hub recommends that you create a metric filter and alarm for changes to network gateways.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.12 Ensure a log metric filter and alarm exist for changes to network gateways
• 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
• 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
• 4.12 Ensure a log metric filter and alarm exist for changes to network gateways
• 4.12 Ensure changes to network gateways are monitored
• 4.12 Ensure changes to network gateways are monitored
• 4.12 Ensure changes to network gateways are monitored
• 4.12 Ensure changes to network gateways are monitored
• Ensure a log metric filter and alarm exist for changes to network gateways

SQL