Query: Ensure a log metric filter and alarm exist for unauthorized API calls

Description

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for unauthorized API calls.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls
• 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
• 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
• 4.1 Ensure a log metric filter and alarm exist for unauthorized API calls
• 4.1 Ensure unauthorized API calls are monitored
• 4.1 Ensure unauthorized API calls are monitored
• 4.1 Ensure unauthorized API calls are monitored
• 4.1 Ensure unauthorized API calls are monitored
• Ensure a log metric filter and alarm exist for unauthorized API calls

SQL