AWS Access control alerts with CloudWatch and CloudTrail

Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console. Open IP Lab Portal

​

Overview

​

Lab details

1. This lab walks you through the steps to create a Cloudtrail and CloudWatch log group , while also creating a metric filter to receive an alarm from CloudWatch via SNS topic.
2. Duration: 1 hour
3. AWS Region: US East (N. Virginia) us-east-1

​

Introduction

​

Cloudwatch

1. AWS Cloudwatch is the service that is used to monitor and collect the metrics from services periodically. This helps provide a clear picture for the users to understand how the resources are performing.
2. It collects data in the form of logs, events and metrics and provides you with an organized view of AWS resources, services and applications that run on AWS.
3. You can use CloudWatch to detect anomalous behavior in your environments and to set alarms, You can visualize data from the logs and take actions to troubleshoot the issue.
4. You can monitor AWS resources such as Amazon EC2, Amazon RDS, Amazon DynamoDB tables, and many others using CloudWatch.
5. You can monitor resource utilization in your account by setting up rules and events tto stop or terminate underutilized resources, reducing unnecessary cost.
6. In Autoscaling, servers are stopped or launched based on the events we create in CloudWatch.
7. CloudWatch also offers a feature to store logs for the services running in our account. For example, the logs for lambda functions will be stored within log groups in CloudWatch. Here we can get a detailed error log from any specific function.

​

CloudTrail

1. AWS CloudTrail is a service that helps us monitor, survey, and audit our AWS Account.
2. With the help of AWS CloudTrail, the user will be able to log, monitor, and retain account activity associated with actions across the AWS infrastructure.
3. CloudTrail provides complete account activity of the Amazon Web Services. CloudTrail also manages the functions performed with the help of the AWS Management Console, program line tools, AWS SDKs, and various other AWS services.
4. This event history simplifies security analysis, resource amendment trailing, and troubleshooting.

​

Architecture diagram

​

Task details

1. Sign in to AWS Management Console
2. Creating a CloudTrail
3. Creating Metric Filters for Log Groups in Cloudwatch
4. Creating an Alarm.
5. Creating an EC2 instance to Trigger our alarm.
6. Validation of the lab

​

Launching the lab environment

1. To launch the lab environment, Click on the Launch lab button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with IAM user name, Password, Access Key, and Secret Access Key.

​

Lab guide

​

Lab steps

​

Task 1: Sign in to AWS Management Console

1. Click on the Open console button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
   • Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
   • Now copy your User Name and Password in the Lab Console to the IAM Username and Password in AWS Console and click on the Sign in button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as US East (N. Virginia) us-east-1.
4. Select Maybe later in New AWS Console Home page pop-up

​

Task 2: Creating a CloudTrail

1. Make sure to choose the N.Virginia region in the AWS Management console dashboard (present in the top right corner).
2. Navigate and click on CloudTrail, which will be available under the Management & Governance section of Services .
3. Click on Trails on the left side and then click on Create Trails
4. Under Create Trail, enter these details:
   • Trail name: Enter My_cloudtrail and Uncheck Log file SSE-KMS encryption.

5 . Scroll down you can see Cloudwatch logs section.

• CloudWatch Logs : Check Enabled
  • Log group : Leave it as default (i.e New and default log group name )
  • IAM Role : Select Existing and select the Role with name as whiz_cloudtrail_role-xxxx
• Tags-optional:
  • Key: Enter Name
  • Value: Enter my_logs
    • Click Next**.**

• Leave Events as Default and Click on Next and Review then Click on Create Trail.

6. A CloudTrail instance that delivers logs to an S3 bucket has now been created.

NOTE: Ignore the createpolicy error in pop-up.

​

Task 3: Creating an EC2 Instance to Trigger our Alarm

1. Make sure you are in the N.Virginia Region.
2. Navigate to EC2 by clicking on the services menu in the top, then click on EC2 in the Compute section
3. Navigate to Instances on the left panel and click on launch instances
4. Name : Enter MyEC2Server

5. For Amazon Machine Image (AMI): Select Amazon Linux 2023 kernel-6.1 AMI in the search box.

6. For Instance Type: select t2.micro

7. For Key pair: Select Create a new key pair Button

• Key pair name: WhizKey
• Key pair type: RSA
• Private key file format: .pem

8. Select Create key pair Button.
9. In Network Settings Click on Edit :

• Auto-assign public IP: Enable
• Select Create new Security group
• Security group name : Enter MyEC2Server_SG
• Description : Enter Security Group to allow traffic to EC2
• Check Allow SSH from and Select Anywhere from dropdown.
• To add SSH , Choose Type: SSH
• Source: Select Anywhere

10. Keep rest thing as Default and Click on Launch Instance Button.
11. Select View all Instances to View Instance you Created.
12. Launch Status : Your instance is now launching, Click on the instance ID and wait for complete initialization of instance.

​

Task 4: Creating Metric Filters for Log Groups in Cloudwatch

1. Make sure you are in the N.Virginia Region.
2. Click on Services and navigate to the CloudWatch dashboard under Management & Governance .
3. Click on Log groups under Log Management in the left panel.
4. Click on the log group we just created and click on the Actions.
5. Click on create metric filter.
6. Under Create filter pattern, provide the pattern you need to filter on. For this lab, we are going to filter for stopped instances .

• Filter pattern : Enter the pattern { $.eventName= “StopInstances” }
• Select log data to test : Select the cloudtrail log in drop-down.
• After completing the above steps, click on Next.

7. Next we will create a filter using the following details:

• Filter name: Enter stoppedInstancecount
• Metric details:
  • Metric namespace : Enter CloudTrailMetrics
  • Metric name : Enter EC2stoppedInstanceEventCount
  • Metric value : Enter 1
  • Default value : Leave default
• Finally, click on and Next button and review the given details. Click on Create metric filter to complete the metric filter creation.

​

Task 5: Creating an Alarm

1. In CloudWatch, select the log group created for our CloudTrail and then click on metric filters at the bottom.
2. Select the Metric filter created in the above step and then click on create alarm as shown below:
3. Specify the metric conditions as follows:

• Namespace : CloudTrailMetrics (default)
• Metric name : EC2stoppedInstanceEventCount (default)
• Statistic : sum (default)
• Period : 5 minute (default)
• Conditions: Threshold type: Select Static
• Whenever EC2stoppedInstanceEventCount is : Greater/Equal than 1.
• Click on Next.

4. Next we’ll configure actions

• Alarm state trigger : Select in alarm
• Select an SNS topic : Select Create new topc
• Create a new topic : Enter the topic name as My_Ec2count_topic
• Email endpoints that will receive the notification : Enter your Email address to receive the alert
• Once you provide these details, click on create topic .
• AWS will send a confirmation email to the Email address provided above. You will need to confirm the email subscription.

  Note: If you are not getting any mail from AWS confirmation, Please check your spam

• Click on the next button.

5. Give the name for your alarm and complete the steps as shown below:

• Alarm name : Enter My_stopped_ec2_alarm
• Alarm description : Enter Alarm to count the stopped instances count
• Click on the Next button. Review the details and click on create alarm .

6. Navigate to the CloudWatch dashboard and click on alarms. You should see the alarm created in the above step under insufficient data as shown below:

7 . Once the EC2 instance launches successfully, stop and start the instance 2 to 3 times as shown in the below screenshot and keep the instance state as stop for successful validation.

8. Navigate to the CloudWatch console and click on In alarm under Alarms on the left side panel to see the newly-created alarm. It should show the state as In alarm, as shown below:

​

Task 6: Validation Test

1. Once the lab steps are completed, please click on the Validate button on the Right side panel.
2. This will validate the resources in the AWS account and display whether you have completed this lab successfully or not.
3. Sample output :

​

Completion and conclusion

1. You have successfully created a CloudTrail and an S3 bucket to store logs.
2. You have created CloudWatch log groups and a metric filter for stopped EC2 instances.
3. You have successfully created SNS topic to receive the alert from CloudWatch.
4. You have successfully launched an EC2 instance.
5. You successfully stopped the instance a few times to check the working of the alarm.

​

End lab

1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on End lab in the IP Lab Portal.

​

What gets checked

When you press Check my work, the platform verifies each of these:

• Check EC2 Instance Stopped State — Check whether the EC2 instance is in a stopped state.
• Create an Amazon SNS Topic — Check If SNS Topic created or not
• Check Cloudtrail logs — Check whether cloudtrail log is created or not
• Check Metric Filter — Check whether the CloudWatch metric filter is created.
• Check CloudWatch Alarm Creation — Check whether at least one CloudWatch alarm exists or not.

​

Related help

• FAQs and Troubleshooting
• SSH into EC2 Instance