Control: 2.13 Ensure log monitoring and alerts are set up for VPC changes


It is recommended that a log search/analysis query and alarm be established for VPC changes.


Perform the following to ensure the log monitoring and alerts are set up for VPC changes:

From Console

  1. Logon to SLS Console.
  2. Click Log Service Audit Service in the navigation pane.
  3. Go to Access to Cloud Products > Global Configuration page.
    • Select a location of project for logs.
    • Check the Action Trail and configure a proper days.
    • Click Save to save the changes.
  4. Go to Access to Cloud Products > Global Configurations click Central Project.
  5. Select Log Management > Actiontrail Log.
  6. In the search/analytics console, input below query
("event.serviceName": Ecs or "event.serviceName": Vpc) and ("event.eventName": CreateVpc or "event.eventName": DeleteVpc or "event.eventName": DisableVpcClassicLink or "event.eventName": EnableVpcClassicLink or "event.eventName": DeletionProtection or "event.eventName": AssociateVpcCidrBlock or "event.eventName": UnassociateVpcCidrBlock or "event.eventName": RevokeInstanceFromCen or "event.eventName": CreateVSwitch or "event.eventName": DeleteVSwitch or "event.eventName": CreateVSwitch) | select count(1) as c
  1. Create a dashboard and set alert for the query result.


Run the control in your terminal:

powerpipe control run alicloud_compliance.control.cis_v100_2_13

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run alicloud_compliance.control.cis_v100_2_13 --share


This control uses a named query: