> ## Documentation Index
> Fetch the complete documentation index at: https://cloud-architect.ipoint-labs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS Access control alerts with CloudWatch and CloudTrail
> Hands-on lab · 45m
Launch this lab in the IP Lab Portal, then follow the steps below in the AWS console.
Open IP Lab Portal
## Overview
### Lab details
1. This lab walks you through the steps to create a Cloudtrail and CloudWatch log group , while also creating a metric filter to receive an alarm from CloudWatch via SNS topic.
2. Duration: **1 hour**
3. AWS Region: **US East (N. Virginia) us-east-1**
### Introduction
#### Cloudwatch
1. AWS Cloudwatch is the service that is used to monitor and collect the metrics from services periodically. This helps provide a clear picture for the users to understand how the resources are performing.
2. It collects data in the form of logs, events and metrics and provides you with an organized view of AWS resources, services and applications that run on AWS.
3. You can use CloudWatch to detect anomalous behavior in your environments and to set alarms, You can visualize data from the logs and take actions to troubleshoot the issue.
4. You can monitor AWS resources such as Amazon EC2, Amazon RDS, Amazon DynamoDB tables, and many others using CloudWatch.
5. You can monitor resource utilization in your account by setting up rules and events tto stop or terminate underutilized resources, reducing unnecessary cost.
6. In Autoscaling, servers are stopped or launched based on the events we create in CloudWatch.
7. CloudWatch also offers a feature to store logs for the services running in our account. For example, the logs for lambda functions will be stored within log groups in CloudWatch. Here we can get a detailed error log from any specific function.
#### CloudTrail
1. AWS CloudTrail is a service that helps us monitor, survey, and audit our AWS Account.
2. With the help of AWS CloudTrail, the user will be able to log, monitor, and retain account activity associated with actions across the AWS infrastructure.
3. CloudTrail provides complete account activity of the Amazon Web Services. CloudTrail also manages the functions performed with the help of the **AWS Management Console**, program line tools, AWS SDKs, and various other AWS services.
4. This event history simplifies security analysis, resource amendment trailing, and troubleshooting.
### Architecture diagram
### Task details
1. Sign in to AWS Management Console
2. Creating a CloudTrail
3. Creating Metric Filters for Log Groups in Cloudwatch
4. Creating an Alarm.
5. Creating an EC2 instance to Trigger our alarm.
6. Validation of the lab
### Launching the lab environment
1. To launch the lab environment, Click on the **Launch lab** button.
2. Please wait until the cloud environment is provisioned. It will take less than a minute to provision.
3. Once the Lab is started, you will be provided with **IAM user name**, **Password**, **Access** **Key**, and **Secret** **Access** **Key**.
You can only start one lab at any given time
## Lab guide
#### Lab steps
#### Task 1: Sign in to AWS Management Console
1. Click on the **Open console** button, and you will get redirected to AWS Console in a new browser tab.
2. On the AWS sign-in page,
* Leave the Account ID as default. Never edit/remove the 12 digit Account ID present in the AWS Console. otherwise, you cannot proceed with the lab.
* Now copy your **User Name** and **Password** in the Lab Console to the **IAM Username and Password** in AWS Console and click on the **Sign in** button.
3. Once Signed In to the AWS Management Console, Make the default AWS Region as **US East (N. Virginia) us-east-1.**
4. Select Maybe later in New AWS Console Home page pop-up
#### Task 2: Creating a CloudTrail
1. Make sure to choose the **N.Virginia** region in the AWS Management console dashboard (present in the top right corner).
2. Navigate and click on **CloudTrail,** which will be available under the **Management & Governance** section of **Services** .
3. Click on **Trails** on the left side and then click on **Create Trails**
4. Under Create Trail, enter these details:
* Trail name: Enter **My\_cloudtrail** and **Uncheck** Log file SSE-KMS encryption.
5 . Scroll down you can see Cloudwatch logs section.
* CloudWatch Logs : **Check** Enabled
* Log group : Leave it as default (i.e New and default log group name )
* IAM Role : Select **Existing** and select the Role with name as ***whiz\_cloudtrail\_role-xxxx***
* Tags-optional:
* Key: Enter ***Name***
* Value: Enter ***my\_logs***
* Click Next\*\*.\*\*
* Leave Events as Default and Click on **Next** and Review then Click on **Create Trail.**
6. A CloudTrail instance that delivers logs to an S3 bucket has now been created.
> **NOTE:** Ignore the createpolicy error in pop-up.
#### Task 3: Creating an EC2 Instance to Trigger our Alarm
1. Make sure you are in the **N.Virginia** Region.
2. Navigate to **EC2** by clicking on the **services** menu in the top, then click on **EC2** in the **Compute** section
3. Navigate to **Instances** on the left panel and click on **launch instances**
4. Name : Enter ***MyEC2Server***
5. **For Amazon Machine Image (AMI):** Select **Amazon Linux 2023 kernel-6.1 AMI** in the search box.
6. **For Instance Type:** select ***t2.micro***
7. **For Key pair:** Select **Create a new key pair** Button
* Key pair name: **WhizKey**
* Key pair type: **RSA**
* Private key file format: **.pem**
8. Select **Create key pair** Button.
9. In Network Settings Click on **Edit** :
* Auto-assign public IP: **Enable**
* Select **Create new Security group**
* Security group name : Enter ***MyEC2Server\_SG***
* Description : Enter ***Security Group to allow traffic to EC2***
* Check **Allow SSH from** and Select **Anywhere** from dropdown.
* To add **SSH** , Choose Type: **SSH**
* Source: Select **Anywhere**
10. Keep rest thing as Default and Click on **Launch Instance** Button.
11. Select **View all Instances** to View Instance you Created.
12. **Launch Status :** Your instance is now launching, Click on the instance ID and wait for complete initialization of instance.
#### Task 4: Creating Metric Filters for Log Groups in Cloudwatch
1. Make sure you are in the **N.Virginia** Region.
2. Click on **Services** and navigate to the **CloudWatch** dashboard under **Management & Governance** .
3. Click on **Log groups** under **Log Management** in the left panel.
4. Click on the log group we just created and click on the **Actions.**
5. Click on **create metric filter**.
6. Under **Create filter pattern,** provide the pattern you need to filter on. For this lab, we are **going to filter for stopped instances** .
* Filter pattern : Enter the pattern ***\{ \$.eventName= "StopInstances" }***
* Select log data to test : Select the **cloudtrail log** in drop-down.
* After completing the above steps, click on **Next.**
7. Next we will create a filter using the following details:
* Filter name: Enter ***stoppedInstancecount***
* Metric details:
* Metric namespace : Enter ***CloudTrailMetrics***
* Metric name : Enter ***EC2stoppedInstanceEventCount***
* Metric value : Enter ***1***
* Default value : Leave default
* Finally, click on and **Next** button and review the given details. Click on **Create metric filter** to complete the metric filter creation.
#### Task 5: Creating an Alarm
1. In CloudWatch, select the log group created for our CloudTrail and then click on **metric filters** at the bottom.
2. Select the Metric filter created in the above step and then click on **create alarm** as shown below:
3. Specify the metric conditions as follows:
* Namespace : **CloudTrailMetrics (default)**
* Metric name : **EC2stoppedInstanceEventCount (default)**
* Statistic : **sum (default)**
* Period : **5 minute (default)**
* Conditions: Threshold type: Select **Static**
* Whenever EC2stoppedInstanceEventCount is : **Greater/Equal** than ***1***.
* Click on **Next**.
4. Next we'll **configure actions**
* Alarm state trigger : Select **in alarm**
* Select an SNS topic : Select **Create new topc**
* Create a new topic : Enter the topic name as ***My\_Ec2count\_topic***
* Email endpoints that will receive the notification : Enter your Email address to receive the alert
* Once you provide these details, click on **create topic** .
* AWS will send a confirmation email to the Email address provided above. You will need to confirm the email subscription.
> **Note:** If you are not getting any mail from AWS confirmation, Please check your spam
* Click on the **next** button.
5. Give the name for your alarm and complete the steps as shown below:
* Alarm name : Enter ***My\_stopped\_ec2\_alarm***
* Alarm description : Enter ***Alarm to count the stopped instances count***
* Click on the **Next** button. Review the details and click on **create alarm** .
6. Navigate to the CloudWatch dashboard and click on alarms. You should see the alarm created in the above step under **insufficient data** as shown below:
7 . Once the EC2 instance launches successfully, **stop and start the instance 2 to 3 times** as shown in the below screenshot and keep the instance state as **stop** for successful validation.
8. Navigate to the CloudWatch console and click on **In alarm** under **Alarms** on the left side panel to see the newly-created alarm. It should show the state as **In alarm**, as shown below:
**Do you know?**
AWS Access Control Alerts with CloudWatch and CloudTrail are mechanisms provided by Amazon Web Services (AWS) to monitor and track access and authorization events within your AWS environment. They help detect and notify you about potential security issues, unauthorized access attempts, and unusual activity.
#### Task 6: Validation Test
1. Once the lab steps are completed, please click on the **Validate** button on the Right side panel.
2. This will validate the resources in the AWS account and display whether you have completed this lab successfully or not.
3. Sample output :
### Completion and conclusion
1. You have successfully created a CloudTrail and an S3 bucket to store logs.
2. You have created CloudWatch log groups and a metric filter for stopped EC2 instances.
3. You have successfully created SNS topic to receive the alert from CloudWatch.
4. You have successfully launched an EC2 instance.
5. You successfully stopped the instance a few times to check the working of the alarm.
### End lab
1. Sign out of AWS Account.
2. You have successfully completed the lab.
3. Once you have completed the steps, click on **End lab** in the IP Lab Portal.
## What gets checked
When you press **Check my work**, the platform verifies each of these:
* **Check EC2 Instance Stopped State** — Check whether the EC2 instance is in a stopped state.
* **Create an Amazon SNS Topic** — Check If SNS Topic created or not
* **Check Cloudtrail logs** — Check whether cloudtrail log is created or not
* **Check Metric Filter** — Check whether the CloudWatch metric filter is created.
* **Check CloudWatch Alarm Creation** — Check whether at least one CloudWatch alarm exists or not.
## Related help
* [FAQs and Troubleshooting](/aws-cp/support/faqs-and-troubleshooting)
* [SSH into EC2 Instance](/aws-cp/support/ssh-into-ec2-instance)