Control: 2.13 Ensure log monitoring and alerts are set up for VPC changes
Description
It is recommended that a log search/analysis query and alarm be established for VPC changes.
Remediation
Perform the following to ensure the log monitoring and alerts are set up for VPC changes:
From Console
- Logon to SLS Console.
- Click
Log Service Audit Servicein the navigation pane. - Go to
Access to Cloud Products > Global Configurationpage.- Select a location of project for logs.
- Check the
Action Trailand configure a proper days. - Click
Saveto save the changes.
- Go to
Access to Cloud Products > Global ConfigurationsclickCentral Project. - Select
Log Management > Actiontrail Log. - In the search/analytics console, input below query
("event.serviceName": Ecs or "event.serviceName": Vpc) and ("event.eventName": CreateVpc or "event.eventName": DeleteVpc or "event.eventName": DisableVpcClassicLink or "event.eventName": EnableVpcClassicLink or "event.eventName": DeletionProtection or "event.eventName": AssociateVpcCidrBlock or "event.eventName": UnassociateVpcCidrBlock or "event.eventName": RevokeInstanceFromCen or "event.eventName": CreateVSwitch or "event.eventName": DeleteVSwitch or "event.eventName": CreateVSwitch) | select count(1) as c
- Create a dashboard and set alert for the query result.
Usage
Run the control in your terminal:
powerpipe control run alicloud_compliance.control.cis_v100_2_13Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run alicloud_compliance.control.cis_v100_2_13 --shareSQL
This control uses a named query:
select 'arn:acs:::' || account_id as resource, 'info' as status, 'Manual verification required.' as reason , account_id as account_idfrom alicloud_account;