No CloudWatch alarm for IAM policy changes

Severity: Medium
Service: Monitoring and alarms
Check ID: CLOUDWATCH_ALARM_IAM_POLICY_CHANGES

What this check finds

No CloudWatch Logs metric filter and alarm cover IAM policy change events (CreatePolicy, DeletePolicy, AttachRolePolicy, etc.). Without this alarm, privilege escalation via IAM changes goes undetected in real time. CIS v1.4 §4.4.

Passing looks like: CloudWatch alarm for IAM policy changes configured.

How to fix it

Create a CloudWatch Logs metric filter on the CloudTrail log group covering IAM policy events, then create a CloudWatch alarm on that metric.

AWS console

CloudWatch → Log groups → select CloudTrail group → Metric filters → Create → enter filter pattern including CreatePolicy, DeletePolicy, AttachRolePolicy, DetachRolePolicy → create metric → create alarm with SNS notification.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to No CloudWatch alarm for IAM policy changes
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	4.4 Ensure IAM policy changes are monitored
NIST SP 800-53 Rev5 (Moderate)	AU-6 Audit Record Review, Analysis, and Reporting CM-5 Access Restrictions for Change SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege DE.AE-02 Adverse events are analyzed DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.9 Configuration management A.8.16 Monitoring activities

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Monitoring and alarms checks

All Monitoring and alarms checks