Help remediating AWS CloudWatch 1-14 Security Controls
Currently in order to setup auto-remediation for the Cloudwatch controls 1-14 you need to perform some initial configuration.
The following information takes you through what needs to be checked in order to perform auto-remediation on Cloudwatch controls 1-14 in AUTOMATE+.
Goal - ability to use Auto-remediation for controls Cloudwatch.1 → Cloudwatch.14
A select number of controls, namely Cloudwatch.1 → Cloudwatch.14 require additional manual effort in order for a customer to leverage the auto-remediation toggle.
IMPORTANT NOTE: Skip the below steps if the controls are already showing as PASSED except for CloudTrail.1
Once the following steps have been completed you may then use “Auto-remediation” with AUTOMATE+ for Cloudwatch.1 → Cloudwatch.14:
Steps:
1. After AUTOMATE+ deployment, or if you have already deployed AUTOMATE+;
a. Check the CloudTrail.1 control
i. If the control is failed in AUTOMATE+, expand the control on the Automation page and click Remediate in the dropdown. This will create a Multi-region CloudTrail for you.
ii. If you have not clicked the Remediate button before AND the control is passed, it is likely that you have previously already setup a Multi-Region Account CloudTrail or there is already a local Account multi-region CloudTrail or one associated with the management account of the AWS Organisation. In this case, we will not be able to use the existing deployment of CloudTrail and you will not be able to click Remediate as the control will already show as 'passed'. In the case that you cannot perform as it already exists as per previous step, then you will need to create a new CloudTrail manually so that we can align it with the Security Hub Controls.
1. Navigate to AWS CloudTrail
2. Click on Dashboard (from the left-hand menu)
3. Click on Create Trail
4. Use CloudTrail name: multi-region-cloud-trail
5. Create new S3 bucket (use automatic name prefilled)
6. SSE-KMS encryption: leave checked
7. KMS Alias: select Existing
8. Select Existing KMS alias: SO0111-SHARR-Remediation-Key
9. Log File Validation: Leave Checked
10. SNS Notification Delivery: Leave unchecked
11. CloudWatch Logs: select Enable
12. Paste in the following CloudWatch log group name: six-pillars-aws-cloudwatch-cloudtrail
13. For Assumed Role, select Existing and choose: SO0111-CloudTrailToCloudWatchLogs
14. Click Next
15. Click Next again
16. Click Create Trail
b. CloudTrail.4
i. If the control is FAILED, trigger instance remediation via the Automation page.
c. CloudTrail.5
i. if the control is FAILED, trigger instance remediation via the Automation page.
ii. if you created a new trail following step 1.a.ii. Please follow below steps or wait for that resource show up in Cloudtrail.5 as a resource and trigger instance remediation to correct this.
iii. This step needs to be done manually (unless already completed at step 1.a.ii/1.c.i /1.c.ii)
1. Go to CloudTrail and select the multi-region-cloud-trail
2. Click EDIT on the Cloudwatch Logs section
a. Check Enabled checkbox
b. Select Existing Log Group and paste in: six-pillars-aws-cloudwatch-cloudtrail
c. Select New IAM Role and paste in: six-pillars-aws-cloudwatch-cloudtrail
d. Click Save Changes
e. CloudTrail.2
i. If the control is FAILED, trigger instance remediation via the Automation page.
2. Once all of the controls above are in a PASSED compliance status, trigger instance remediation on Cloudwatch.1 via the Automation page.
a. The automation of Cloudwatch.1 will create an SNS topic named SO0111-SHARR- LocalAlarmNotification you need to create a subscription to this sns topic:
i. Go to SNS topics select topic SO0111-SHARR-LocalAlarmNotification
ii. Click Create Subscription
iii. Select Protocol as Email and then enter your preferred email address or group address.
iv. Click Create subscription
v. Once you have done this you will receive a email to your inbox, you must open and click on the link to accept the subscription.
vi. If you navigate again to SNS topic “SO0111-SHARR-LocalAlarmNotification” you would see a confirmed subscription.
If you need help, please contact support@6pillars.ai
