aws-remediate-cis-securityhub/cft/aws-cis-cloudwatchlogmetricfilters-v2.yml [164:236]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ComparisonOperator: GreaterThanOrEqualToThreshold
  IAMPolicyChangesFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudTrailLogGroup
      FilterPattern: |-
        {
          ($.eventName=DeleteGroupPolicy) ||
          ($.eventName=DeleteRolePolicy) ||
          ($.eventName=DeleteUserPolicy) ||
          ($.eventName=PutGroupPolicy) ||
          ($.eventName=PutRolePolicy) ||
          ($.eventName=PutUserPolicy) ||
          ($.eventName=CreatePolicy) ||
          ($.eventName=DeletePolicy) ||
          ($.eventName=CreatePolicyVersion) ||
          ($.eventName=DeletePolicyVersion) ||
          ($.eventName=AttachRolePolicy) ||
          ($.eventName=DetachRolePolicy) ||
          ($.eventName=AttachUserPolicy) ||
          ($.eventName=DetachUserPolicy) ||
          ($.eventName=AttachGroupPolicy) ||
          ($.eventName=DetachGroupPolicy)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: LogMetrics
        MetricName: IAMPolicyChangeEventCount



# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 1.20 Ensure a support role has been created to manage incidents with AWS Support
# --------------------------------------------------------------------------------------------------------------------------------------------

  CISSupportRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub cissupportrole-${AWS::Region}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
            Principal:
              AWS:
                'Fn::Join':
                  - ''
                  - - 'arn:aws:iam::'
                    - Ref: 'AWS::AccountId'
                    - ':root'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSSupportAccess'


# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes 
# --------------------------------------------------------------------------------------------------------------------------------------------
  CloudtrailConfigChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Cloudtrail Config Changes
      AlarmDescription: Alarm if the configuration for Cloudtrail changes
      MetricName: CloudtrailConfigChangeEventCount
      Namespace: LogMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



aws-remediate-cis-securityhub/cft/aws-cis-cloudwatchlogmetricfilters.yml [136:208]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ComparisonOperator: GreaterThanOrEqualToThreshold
  IAMPolicyChangesFilter:
    Type: AWS::Logs::MetricFilter
    Properties:
      LogGroupName: !Ref CloudTrailLogGroup
      FilterPattern: |-
        {
          ($.eventName=DeleteGroupPolicy) ||
          ($.eventName=DeleteRolePolicy) ||
          ($.eventName=DeleteUserPolicy) ||
          ($.eventName=PutGroupPolicy) ||
          ($.eventName=PutRolePolicy) ||
          ($.eventName=PutUserPolicy) ||
          ($.eventName=CreatePolicy) ||
          ($.eventName=DeletePolicy) ||
          ($.eventName=CreatePolicyVersion) ||
          ($.eventName=DeletePolicyVersion) ||
          ($.eventName=AttachRolePolicy) ||
          ($.eventName=DetachRolePolicy) ||
          ($.eventName=AttachUserPolicy) ||
          ($.eventName=DetachUserPolicy) ||
          ($.eventName=AttachGroupPolicy) ||
          ($.eventName=DetachGroupPolicy)
        }
      MetricTransformations:
      - MetricValue: '1'
        MetricNamespace: LogMetrics
        MetricName: IAMPolicyChangeEventCount



# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 1.20 Ensure a support role has been created to manage incidents with AWS Support
# --------------------------------------------------------------------------------------------------------------------------------------------

  CISSupportRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub cissupportrole-${AWS::Region}
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
            Principal:
              AWS:
                'Fn::Join':
                  - ''
                  - - 'arn:aws:iam::'
                    - Ref: 'AWS::AccountId'
                    - ':root'
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Sub 'arn:${AWS::Partition}:iam::aws:policy/AWSSupportAccess'


# --------------------------------------------------------------------------------------------------------------------------------------------
# CIS AWS Foundations Benchmark - 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes 
# --------------------------------------------------------------------------------------------------------------------------------------------
  CloudtrailConfigChangesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmName: CIS-Cloudtrail Config Changes
      AlarmDescription: Alarm if the configuration for Cloudtrail changes
      MetricName: CloudtrailConfigChangeEventCount
      Namespace: LogMetrics
      Statistic: Sum
      Period: 300
      EvaluationPeriods: 1
      Threshold: 1
      TreatMissingData: notBreaching
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



