AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CloudWatchAlarm:
    Type: 'AWS::CloudWatch::Alarm'
    Properties:
      AlarmName: no_mfa_console_logins
      AlarmDescription: >-
        A CloudWatch Alarm that triggers if there is a Management Console
        sign-in without MFA.
      MetricName: ConsoleSigninWithoutMFA
      Namespace: CloudTrailMetrics
      Statistic: Sum
      Period: '60'
      EvaluationPeriods: '1'
      Threshold: '1'
      ComparisonOperator: GreaterThanOrEqualToThreshold
      AlarmActions:
        - ''
      TreatMissingData: notBreaching
  MetricFilter:
    Type: 'AWS::Logs::MetricFilter'
    Properties:
      LogGroupName: ''
      FilterPattern: >-
        {($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed !=
        "Yes") && ($.responseElements.ConsoleLogin != "Failure") &&
        ($.additionalEventData.SamlProviderArn NOT EXISTS) }
      MetricTransformations:
        - MetricValue: '1'
          MetricNamespace: CloudTrailMetrics
          MetricName: ConsoleSigninWithoutMFA
Parameters: {}
Metadata: {}
Conditions: {}