Question 71848 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Cloudwatch alarm for IAM Policies changes doesn't work – Amazon web services

I’m just trying to create fully functional alarm that will change state if there’s any IAM Policies changes will be made.

  1. Create an S3 Bucket for Cloudtrail logs.
  2. Create trail in Cloudtrail.
  3. Add Metric filter:

{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}

  1. Create Alarm for this filter by using created Metric and Metricname.

If I attach or detach any policy for any IAM Role – nothing happening.

There’s a policies for cloudwatch role:

    "Statement": [
        {
            "Action": [
                "s3:GetBucketAcl",
                "s3:PutObject",
                "cloudtrail:StartLogging",
                "cloudtrail:StopLogging",
                "cloudtrail:Get*",
                "cloudtrail:CreateTrail",
                "cloudtrail:UpdateTrail",
                "iam:CreateServiceLinkedRole",
                "iam:CreateRole",
                "iam:PutRolePolicy",
                "iam:AttachRolePolicy",
                "iam:ListRoles",
                "iam:GetRolePolicy",
                "iam:GetUser",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:GetRole"
                "autoscaling:Describe*",
                "cloudwatch:*",
                "logs:*",
                "sns:*"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Anyone can advise why there’s no changes in alarm state?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Well, I figured it out: It works correctly only in the us-east-1 region. I saw a hint in some instructions, which said something completely different, and decided to try setting up IAM Changes Alarm in another region.

    @shimo, thanks for reassuring me that my settings are completely correct.


  2. 0

    Your Metric filter works fine, and the role is ok (it seems too much, though).

    Try to check your filter can detect from your own trail logs by testing on the console.

    enter image description here

    Check the state of the alarm is OK.

    enter image description here

    Check the Metrics are found properly.

    enter image description here

    Note: I think when setting CW alarms, we need to wait a while (several minutes or so). Immediate actions do not work.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search