Query: Ensure AWS Organizations changes are monitored

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs, and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for AWS Organizations changes made in the master AWS Account.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
• 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
• 4.15 Ensure a log metric filter and alarm exists for AWS Organizations changes
• 4.15 Ensure AWS Organizations changes are monitored
• 4.15 Ensure AWS Organizations changes are monitored
• 4.15 Ensure AWS Organizations changes are monitored
• 4.15 Ensure AWS Organizations changes are monitored
• Ensure AWS Organizations changes are monitored

SQL