<  Back to rules search

AWS Config modified

cloudtrail

Classification:

compliance

Framework:

cis-aws

Control:

4.9

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when an attacker is trying to evade defenses by disabling or modifying AWS Config.

Strategy

This rule lets you monitor these AWS Config API calls per CIS-AWS-4.9: Ensure a log metric filter and alarm exist for AWS Config configuration changes:

Triage and response

  1. Determine which if {{@userIdentity.arn}} should have done a {{@evt.name}} to AWS Config.
  2. If the user did not make the API call:
    • Rotate the credentials.
    • Investigate if the same credentials made other unauthorized API calls.

Changelog

1 April 2022 - Updated rule and signal message.