CloudFormationを使って、CloudWatchLogsフィルタ作成しアラート送信

参考にしたテンプレート

Using an AWS CloudFormation Template to Create CloudWatch Alarms

カスタマイズしたテンプレート

個人的には以下のアラームで十分でした。

• AWSマネジメントコンソールへのログイン失敗アラーム
• IAM権限によるアクセス拒否アラーム
• セキュリティグループ作成・変更・削除アラーム
• EC2インスタンス作成・起動・削除・停止・再起動アラーム

CloudWatch_Alarms_for_CloudTrail_API_Activity_customize.json

{
  "AWSTemplateFormatVersion" : "2010-09-09",
  "Description" : "AWS CloudTrail API Activity Alarm Template for CloudWatch Logs",
  "Parameters" : {
      "LogGroupName" : {
          "Type" : "String",
          "Default" : "CloudTrail/DefaultLogGroup",
          "Description" : "Enter CloudWatch Logs log group name. Default is CloudTrail/DefaultLogGroup"
      },
      "Email" : {
          "Type" : "String",
          "Description" : "Email address to notify when an API activity has triggered an alarm"
      }
  },
  "Resources" : {
      "SecurityGroupChangesMetricFilter": {
          "Type": "AWS::Logs::MetricFilter",
          "Properties": {
              "LogGroupName": { "Ref" : "LogGroupName" },
              "FilterPattern": "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }",
              "MetricTransformations": [
                  {
                      "MetricNamespace": "CloudTrailMetrics",
                      "MetricName": "SecurityGroupEventCount",
                      "MetricValue": "1"
                  }
              ]
          }
      },
      "SecurityGroupChangesAlarm": {
          "Type": "AWS::CloudWatch::Alarm",
          "Properties": {
              "AlarmName" : "SecurityGroupChanges",
              "AlarmDescription" : "セキュリティグループ作成・変更・削除アラーム",
              "AlarmActions" : [{ "Ref" : "AlarmNotificationTopic" }],
              "MetricName" : "SecurityGroupEventCount",
              "Namespace" : "CloudTrailMetrics",
              "ComparisonOperator" : "GreaterThanOrEqualToThreshold",
              "EvaluationPeriods" : "1",
              "Period" : "300",
              "Statistic" : "Sum",
              "Threshold" : "1"
          }
      },
      "EC2InstanceChangesMetricFilter": {
          "Type": "AWS::Logs::MetricFilter",
          "Properties": {
              "LogGroupName": { "Ref" : "LogGroupName" },
              "FilterPattern": "{ ($.eventName = RunInstances) || ($.eventName = RebootInstances) || ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName = TerminateInstances) }",
              "MetricTransformations": [
                  {
                      "MetricNamespace": "CloudTrailMetrics",
                      "MetricName": "EC2InstanceEventCount",
                      "MetricValue": "1"
                  }
              ]
          }
      },
      "EC2InstanceChangesAlarm": {
          "Type": "AWS::CloudWatch::Alarm",
          "Properties": {
              "AlarmName" : "EC2InstanceChanges",
              "AlarmDescription" : "EC2インスタンス作成・起動・削除・停止・再起動アラーム",
              "AlarmActions" : [{ "Ref" : "AlarmNotificationTopic" }],
              "MetricName" : "EC2InstanceEventCount",
              "Namespace" : "CloudTrailMetrics",
              "ComparisonOperator" : "GreaterThanOrEqualToThreshold",
              "EvaluationPeriods" : "1",
              "Period" : "60",
              "Statistic" : "Sum",
              "Threshold" : "1"
          }
      },
      "ConsoleSignInFailuresMetricFilter": {
          "Type": "AWS::Logs::MetricFilter",
          "Properties": {
              "LogGroupName": { "Ref" : "LogGroupName" },
              "FilterPattern": "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }",
              "MetricTransformations": [
                  {
                      "MetricNamespace": "CloudTrailMetrics",
                      "MetricName": "ConsoleSignInFailureCount",
                      "MetricValue": "1"
                  }
              ]
          }
      },
      "ConsoleSignInFailuresAlarm": {
          "Type": "AWS::CloudWatch::Alarm",
          "Properties": {
              "AlarmName" : "ConsoleSignInFailures",
              "AlarmDescription" : "AWSマネジメントコンソールへのログイン失敗アラーム",
              "AlarmActions" : [{ "Ref" : "AlarmNotificationTopic" }],
              "MetricName" : "ConsoleSignInFailureCount",
              "Namespace" : "CloudTrailMetrics",
              "ComparisonOperator" : "GreaterThanOrEqualToThreshold",
              "EvaluationPeriods" : "1",
              "Period" : "300",
              "Statistic" : "Sum",
              "Threshold" : "3"
          }
      },

      "AuthorizationFailuresMetricFilter": {
          "Type": "AWS::Logs::MetricFilter",
          "Properties": {
              "LogGroupName": { "Ref" : "LogGroupName" },
              "FilterPattern": "{ ($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode = \"AccessDenied*\") }",
              "MetricTransformations": [
                  {
                      "MetricNamespace": "CloudTrailMetrics",
                      "MetricName": "AuthorizationFailureCount",
                      "MetricValue": "1"
                  }
              ]
          }
      },
      "AuthorizationFailuresAlarm": {
          "Type": "AWS::CloudWatch::Alarm",
          "Properties": {
              "AlarmName" : "IAMAuthorizationFailures",
              "AlarmDescription" : "IAM権限によるアクセス拒否アラーム",
              "AlarmActions" : [{ "Ref" : "AlarmNotificationTopic" }],
              "MetricName" : "AuthorizationFailureCount",
              "Namespace" : "CloudTrailMetrics",
              "ComparisonOperator" : "GreaterThanOrEqualToThreshold",
              "EvaluationPeriods" : "1",
              "Period" : "300",
              "Statistic" : "Sum",
              "Threshold" : "1"

          }
      },
        "AlarmNotificationTopic": {
          "Type": "AWS::SNS::Topic",
          "Properties": {
              "TopicName" : "CloudTrail-Alarm-AlarmNotification",
              "DisplayName" : "CloudTrailAlarm",
              "Subscription": [
                  {
                      "Endpoint": { "Ref": "Email" },
                      "Protocol": "email"
                  }
              ]
          }
      }
  }
}