---
title: AWS Management Console authentication failures should be monitored
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS Management Console authentication
  failures should be monitored
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# AWS Management Console authentication failures should be monitored
 
## Description{% #description %}

AWS accounts should have at least one active multi-region CloudTrail trail that captures all management events (`IncludeManagementEvents` set to true and `ReadWriteType` set to `All`) and sends its logs to a CloudWatch Logs log group with a metric filter and alarm for failed AWS Management Console authentication attempts. The alarm must notify an SNS topic with at least one active subscriber, which reduces the time to detect brute-force attempts and helps identify source IPs for event correlation.

## Remediation{% #remediation %}

1. Create a metric filter on the trail's log group using the pattern `{ ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }`, as described in [Creating CloudWatch alarms for CloudTrail events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html).
1. Create an SNS topic with at least one subscription, then create a CloudWatch alarm on the filter's metric (for example, `Sum` over 300 seconds with threshold `>= 1`) whose alarm action targets the SNS topic. See [Create a CloudWatch alarm based on a static threshold](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html) and [Subscribing to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html).

## References{% #references %}

- [Working with CloudTrail log files in CloudWatch Logs](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/send-cloudtrail-events-to-cloudwatch-logs.html)
- [Create a CloudWatch alarm based on a static threshold](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ConsoleAlarms.html)
- [Subscribing to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)