Query: Ensure a log metric filter and alarm exist for VPC changes

Description

You can do real-time monitoring of API calls by directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms. You can have more than one VPC in an account, and you can create a peer connection between two VPCs, enabling network traffic to route between VPCs. Security Hub recommends that you create a metric filter and alarm for changes to VPCs.

Query

Tables used in this query:

• aws_account
• aws_cloudtrail_trail
• aws_cloudwatch_alarm
• aws_cloudwatch_log_metric_filter
• aws_sns_topic_subscription

Controls using this query:

• 3.14 Ensure a log metric filter and alarm exist for VPC changes
• 4.14 Ensure a log metric filter and alarm exist for VPC changes
• 4.14 Ensure a log metric filter and alarm exist for VPC changes
• 4.14 Ensure a log metric filter and alarm exist for VPC changes
• 4.14 Ensure VPC changes are monitored
• 4.14 Ensure VPC changes are monitored
• 4.14 Ensure VPC changes are monitored
• 4.14 Ensure VPC changes are monitored
• Ensure a log metric filter and alarm exist for VPC changes

SQL