A CloudWatch Alarm that triggers if there is a Management Console sign-in without MFA.
Prerequisites: This Alarm requires CloudTrail enabled, with events sent to a CloudWatch Log Group. See Related Configuration Items for configuration to enable CloudTrail/CloudWatch, or enter the CloudWatch Log Group name under the Metric Filter Configuration section.
AWSTemplateFormatVersion: '2010-09-09'
Description: ''
Resources:
SnsTopic:
Type: 'AWS::SNS::Topic'
Properties:
Subscription:
- Endpoint: email@example.com
Protocol: email
TopicName: alarm-action
CloudWatchAlarm:
Type: 'AWS::CloudWatch::Alarm'
Properties:
AlarmName: no_mfa_console_logins
AlarmDescription: >-
A CloudWatch Alarm that triggers if there is a Management Console
sign-in without MFA.
MetricName: ConsoleSigninWithoutMFA
Namespace: CloudTrailMetrics
Statistic: Sum
Period: '60'
EvaluationPeriods: '1'
Threshold: '1'
ComparisonOperator: GreaterThanOrEqualToThreshold
AlarmActions:
- Ref: SnsTopic
TreatMissingData: notBreaching
MetricFilter:
Type: 'AWS::Logs::MetricFilter'
Properties:
LogGroupName: ''
FilterPattern: >-
{($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed !=
"Yes") && ($.responseElements.ConsoleLogin != "Failure") &&
($.additionalEventData.SamlProviderArn NOT EXISTS) }
MetricTransformations:
- MetricValue: '1'
MetricNamespace: CloudTrailMetrics
MetricName: ConsoleSigninWithoutMFA
Parameters: {}
Metadata: {}
Conditions: {}
Configuration Source: AWS Quickstart
Additional Documentation: