Repository navigation
fix(detection): global-service rules 2/3/4 as CIS metric-filter alarms (ADR-0014) - #61
Merged
Merged
Conversation
…ts never reach ca-central-1 EventBridge (ADR-0014) Closes issue 007. EventBridge only delivers global-service events (IAM, console sign-in, root) to the us-east-1 bus, so rules 2/3/4 as deployed could never match — and the region-lock SCP (ADR-0009) forbids the AWS-documented fix of creating rules in us-east-1. Chosen fix: CloudWatch Logs metric-filter alarms in ca-central-1 on the member trail's log group, using the CIS AWS Foundations patterns VERBATIM (Security Hub CloudWatch.1/.3/.4 check these exactly). Not a workaround: this is the CIS-canonical implementation for these three detections. - rule 2 (CIS 4.2): expected-but-logged for Identity Center sign-ins (MFAUsed=No at the CloudTrail layer; MFA lives at the IdP) — runbook - rule 3 (CIS 4.3): invokedBy/AwsServiceEvent exclusions drop AWS-service-initiated root noise the old pattern alerted on - rule 4 (CIS 4.4): full 16-event list (old pattern missed DeletePolicy, DeletePolicyVersion) - rule 9: now watches suppression of BOTH transports (DeleteMetricFilter, DeleteAlarms, DisableAlarmActions added) - ADR-0014 records the SCP-forced trade-off; plan.md residual #9 documents the ~5-10 min latency; threat-model + runbook updated per acceptance Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes issue 007 (local tracker): detection rules 2/3/4 (console sign-in without MFA, root usage, IAM policy changes) were EventBridge rules on the ca-central-1 bus, but AWS delivers global-service events only to us-east-1 — so as deployed they could never fire. Verified against AWS docs (EventBridge troubleshooting, "rule matches global service API calls but didn't run").
Why not the AWS-documented fix (us-east-1 rules): the region-lock SCP (ADR-0009, live as of today) denies creating EventBridge rules outside ca-central-1 for workloads-account principals. Our own guardrail forbids option A. Full analysis in ADR-0014.
Chosen fix (option B): CloudWatch Logs metric-filter alarms in ca-central-1 on the member trail's log group — the multi-region trail already lands global-service events there. This is the CIS-canonical implementation: filter patterns are CIS 4.2/4.3/4.4 verbatim, matching what Security Hub CloudWatch.1/.3/.4 check for (they fail if terms are added, so the patterns must not be "improved").
Changes:
ConsoleLoginrecordsMFAUsed: No; MFA lives at the IdP) — runbook "Expected alerts" updatedinvokedBy/AwsServiceEventexclusions (drops AWS-service-initiated root noise)DeletePolicy/DeletePolicyVersion)DeleteMetricFilter/DeleteAlarms/DisableAlarmActionsterraform validate,fmt, andverify-docspass locally. Live-fire acceptance (IAM change and no-MFA sign-in produce SNS alerts) folds into issue 010.🤖 Generated with Claude Code