Alerting

Note : Make sure complete the Setup before continuing with this section.

Creating Alerts via Amazon EventBridge (formerly CloudWatch Events)

In this section, we will use Amazon EventBridge to monitor and alert when an IAM policy is attached to an IAM user. The example is simple and it helps to depict the level of visility that can be gained from using this type of process. The EventBridge Rule created will monitor for a specific event name in CloudTrail, and will use an SNS message to notify regarding and event, when it occurs.

  1. Go to the Amazon EventBridge console.
  2. Once in the EventBridge Console, click on Rules on the Left Side of the screen.
  3. Click on the Create rule button.

  4. Configure the Rule using the following settings:

    • Enter a Name for the rule (e.g. AttachUserPolicy_Event). Create CloudWatch Event Rule Name

    • Event Pattern:

      • Pre-defined pattern by service
      • Service provider: AWS
      • Service Name: IAM
      • Event Type: AWS API Call via CloudTrail
      • Specific operation(s): AttachUserPolicy

    Create CloudWatch Event Rule - Targets: SNS topic - Topic: CloudWatchAlarmsForCloudTrail-AlarmNotificationTopic-XXXXXXXXX Create CloudWatch Event Rule

  5. Click Create and you will see the rule created.

    CloudWatch Event Rule Create Success

Triggering AttachUserPolicy Notification

Now that we have an event we are monitoring, we will create an IAM user and attach a user policy to this user to trigger the notification.

  1. Go to the IAM Console.
  2. Click on Add user.
  3. Set the following values for the user:
    • User name: workshopuser
    • Select AWS access type: AWS Management Console access
    • Console password: Autogeneratted password
    • Requrie password reset: Check the checkbox
  4. Click Next: Permissions.

  5. On the Set permissions page, we will select:

    • Attach existing policies directly
    • Check the checkbox for the AdministratorAccess policy

    Attach User Policy

  6. Click on Next: Tags.

  7. Click Next: Review on the Add tags page.

  8. Click Create user and Close

Once the user is created and the policy has been set, the CloudWatch Event pattern will be triggered and an e-mail will be sent to the e-mail address defined in the setup (i.e. Create CloudWatch Alarms for Security and Network related API activity).

Policy notification

Generating ConsoleLogin Failures

  1. Go to IAM Dashboard in your account and copy the Sign-in URL such as (https://123456789XXX.signin.aws.amazon.com/console) SignInURL

  2. Open a different browser or Incognito window in your current browser and navigate to this Sign-in URL.

    • Account ID: Leave as it is
    • IAM user name: workshopuser
    • Password: Use any wrong password that will force a login failure (don’t use the correct password as we are trying to generate Login Failures) Login

  3. Click Sign in to generate login failures. Repeat this step various a few times. Login Failure

  4. We will use these login failures in Logs Insights section.

As part of sending CloudTrail events to CloudWatch Logs, we also deployed a set of pre-defined CloudWatch Alarms to monitor Network and Security related API activity. In this section, we will trigger one of the network related alarms. Optionally, you can trigger the other CloudWatch Alarms)) created as part of launching the CloudFormation template in the setup.

  1. Go to the VPC console.
  2. Select the default security group.

  3. Click Actions and select Edit inbound rules.

    Edit Security Group

  4. Add a rule with the following settings:

    • Type: All ICMP - IPv4
    • Source: Custom
    • Network: 0.0.0.0/0

  5. Click on Save rules.

    Edit Security Group

Once the alarm is processed, a notification will be sent to the email address configured in the setup. Review the notification to understand what is logged.

Security Group Notification

End of Lab Exercises

Thank you for using this lab.