Get Involved
Query: Ensure a log metric filter and alarm exist for usage of 'root' account
Description
You can do real-time monitoring of API calls directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms.Security Hub recommends that you create a metric filter and alarm for root login attempts. Monitoring for root account logins provides visibility into the use of a fully privileged account and an opportunity to reduce the use of it.
Query
Tables used in this query:
- aws_account
- aws_cloudtrail_trail
- aws_cloudwatch_alarm
- aws_cloudwatch_log_metric_filter
- aws_sns_topic_subscription
Controls using this query:
- 3.3 Ensure a log metric filter and alarm exist for usage of "root" account
- 4.3 Ensure a log metric filter and alarm exist for usage of 'root' account
- 4.3 Ensure a log metric filter and alarm exist for usage of 'root' account
- 4.3 Ensure a log metric filter and alarm exist for usage of "root" account
- 4.3 Ensure usage of 'root' account is monitored
- 4.3 Ensure usage of 'root' account is monitored
- 4.3 Ensure usage of the 'root' account is monitoredd
- 4.3 Ensure usage of the 'root' account is monitoredd
- Ensure a log metric filter and alarm exist for usage of 'root' account