Query: Ensure a log metric filter and alarm exist for route table changes

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. Routing tables route network traffic between subnets and to network gateways. Security Hub recommends that you create a metric filter and alarm for changes to route tables. Monitoring these changes helps ensure that all VPC traffic flows through an expected path.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.13 Ensure a log metric filter and alarm exist for route table changes
• 4.13 Ensure a log metric filter and alarm exist for route table changes
• 4.13 Ensure a log metric filter and alarm exist for route table changes
• 4.13 Ensure a log metric filter and alarm exist for route table changes
• 4.13 Ensure route table changes are monitored
• 4.13 Ensure route table changes are monitored
• 4.13 Ensure route table changes are monitored
• 4.13 Ensure route table changes are monitored
• Ensure a log metric filter and alarm exist for route table changes

SQL