---
title: VPC changes should be monitored
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > VPC changes should be monitored
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# VPC changes should be monitored
 
## Description{% #description %}

AWS accounts should have at least one active multi-region CloudTrail trail that captures all management events (an event selector with `IncludeManagementEvents` set to `true` and `ReadWriteType` set to `All`), sends its logs to CloudWatch Logs, and has a metric filter and alarm for VPC changes (`CreateVpc`, `DeleteVpc`, `ModifyVpcAttribute`, `AcceptVpcPeeringConnection`, `CreateVpcPeeringConnection`, `DeleteVpcPeeringConnection`, `RejectVpcPeeringConnection`, `AttachClassicLinkVpc`, `DetachClassicLinkVpc`, `DisableVpcClassicLink`, `EnableVpcClassicLink`). The alarm must notify an SNS topic with at least one confirmed subscriber so that changes to VPCs that could impact traffic flow are detected in real time.

## Remediation{% #remediation %}

1. Create a metric filter on the log group of the active multi-region trail and an SNS topic with a subscription, as described in the [CloudWatch alarms for CloudTrail guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html):

```plaintext
aws logs put-metric-filter --log-group-name <trail-log-group-name> \
--filter-name <vpc-changes-metric> --metric-transformations \
metricName=<vpc-changes-metric>,metricNamespace='CISBenchmark',metricValue=1 \
--filter-pattern '{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }'
aws sns create-topic --name <sns-topic-name>
aws sns subscribe --topic-arn <sns-topic-arn> --protocol <sns-protocol> --notification-endpoint <sns-subscription-endpoints>
```
Create an alarm on the metric that notifies the SNS topic:
```plaintext
aws cloudwatch put-metric-alarm --alarm-name <vpc-changes-alarm> --metric-name <vpc-changes-metric> \
--statistic Sum --period 300 --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \
--evaluation-periods 1 --namespace 'CISBenchmark' --alarm-actions <sns-topic-arn>
```

## References{% #references %}

- [Creating CloudWatch alarms for CloudTrail events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html)
- [Logging management events with CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html)
- [Create a metric filter for a log group](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CreateMetricFilterProcedure.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)