CloudTrail Security Alerting Stack
CloudWatch metric filters and alarms on CloudTrail for root login, console login without MFA, IAM policy changes, and security group modifications. SNS notifications included.
CloudTrail Security Alerting Stack
CloudTrail records everything, but without alerting you are searching logs after the fact. This stack installs CloudWatch metric filters on your CloudTrail log group and triggers SNS alarms the moment a high-risk event occurs.
Alerts Included
| Alert | Why It Matters |
|---|---|
| Root account login | Root should never be used for daily operations |
| Console sign-in without MFA | Credential compromise indicator |
| IAM policy changes | Privilege escalation vector |
| IAM root access key usage | Root keys should not exist |
| CloudTrail config changes | Attacker covering tracks |
| S3 bucket policy changes | Data exfiltration setup |
| Security group modifications | Firewall rule weakening |
| Network ACL changes | Lateral movement enablement |
| VPC Gateway / route table changes | Traffic interception |
| AWS Config service changes | Compliance tampering |
Notification Options
All alarms publish to a central SNS topic. The stack includes pre-wired subscriptions for email (direct SES), Slack (via Lambda webhook forwarder), and PagerDuty (via SNS HTTPS endpoint). Enable any or all via CloudFormation parameters.
What You Get
cloudtrail-alerting.yaml— CloudFormation template with all 10 metric filters and alarmsslack-forwarder/— Lambda that reformats SNS payloads into Slack Block Kit messagestest-alerts.sh— triggers synthetic CloudTrail events to verify end-to-end alert deliveryREADME.md— parameter reference and tuning guide for noisy alerts
Requirements
An existing CloudTrail trail publishing to a CloudWatch Logs log group. Compatible with the AWS Account Security Bootstrap product deployed in the same account.