cloudtrail.yaml

---
  # Copyright 2024 Electromech cloudtech Pvt. Ltd.
  #
  # Licensed under the Apache License, Version 2.0 (the "License");
  # you may not use this file except in compliance with the License.
  # You may obtain a copy of the License at
  #
  #     http://www.apache.org/licenses/LICENSE-2.0
  #
  # Unless required by applicable law or agreed to in writing, software
  # distributed under the License is distributed on an "AS IS" BASIS,
  # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  # See the License for the specific language governing permissions and
  # limitations under the License.
  
  AWSTemplateFormatVersion: '2010-09-09'
  Description: 'Security: CloudTrail across all regions with a single workload region parameter'
  Metadata:
    'AWS::CloudFormation::Interface':
      ParameterGroups:
        - Label:
            default: 'Parent Stacks'
          Parameters:
            - ParentKmsKeyStack
            - ParentAlertStack
        - Label:
            default: 'CloudTrail Parameters'
          Parameters:
            - CloudWatchLogsRetentionInDays
            - ExternalTrailBucket
            - LogFilePrefix
            - S3DataEvents
            - WorkloadRegion
        - Label:
            default: 'Permission Parameters'
          Parameters:
            - PermissionsBoundary
  
  Parameters:
    ParentKmsKeyStack:
      Description: 'Optional Stack name of parent KMS key stack based on kms-key.yaml template.'
      Type: String
      Default: ''
    ParentAlertStack:
      Description: 'Optional but recommended stack name of parent alert stack based on alert.yaml template.'
      Type: String
      Default: ''
    PermissionsBoundary:
      Description: 'Optional ARN for a policy that will be used as the permission boundary for all roles created by this template.'
      Type: String
      Default: ''
    CloudWatchLogsRetentionInDays:
      Description: 'The number of days log events are kept in CloudWatch Logs'
      Type: Number
      Default: 14
      AllowedValues: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
    ExternalTrailBucket:
      Description: 'Optional The name of the Amazon S3 bucket where CloudTrail publishes log files. If you leave this empty, the Amazon S3 bucket is created for you.'
      Type: String
      Default: ''
    LogFilePrefix:
      Description: 'Optional The log file prefix.'
      Type: String
      Default: ''
    S3DataEvents:
      Description: 'Record data events of all S3 buckets? (Warning: additional charges apply.)'
      Type: String
      Default: 'false'
      AllowedValues:
        - 'true'
        - 'false'
    WorkloadRegion:
      Description: "A single workload region. Example: ap-south-1"
      Type: String
      Default: ap-south-1
  
  Conditions:
    HasKmsKey: !Not [!Equals [!Ref ParentKmsKeyStack, '']]
    HasAlertTopic: !Not [!Equals [!Ref ParentAlertStack, '']]
    HasPermissionsBoundary: !Not [!Equals [!Ref PermissionsBoundary, '']]
    InternalBucket: !Equals [!Ref ExternalTrailBucket, '']
    ExternalBucket: !Not [!Equals [!Ref ExternalTrailBucket, '']]
    HasLogFilePrefix: !Not [!Equals [!Ref LogFilePrefix, '']]
    IsS3DataEvents: !Equals [!Ref S3DataEvents, 'true']
  
  Resources:
    TrailBucket:
      Condition: InternalBucket
      Type: 'AWS::S3::Bucket'
      Properties: {}
  
    TrailBucketPolicy:
      Condition: InternalBucket
      Type: 'AWS::S3::BucketPolicy'
      Properties:
        Bucket: !Ref TrailBucket
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: AWSCloudTrailAclCheck
              Effect: Allow
              Principal:
                Service: 'cloudtrail.amazonaws.com'
              Action: 's3:GetBucketAcl'
              Resource: !Sub 'arn:aws:s3:::${TrailBucket}'
            - Sid: AWSCloudTrailWrite
              Effect: Allow
              Principal:
                Service: 'cloudtrail.amazonaws.com'
              Action: 's3:PutObject'
              Resource: !If 
                - HasLogFilePrefix
                - !Sub 'arn:aws:s3:::${TrailBucket}/${LogFilePrefix}/AWSLogs/${AWS::AccountId}/*'
                - !Sub 'arn:aws:s3:::${TrailBucket}/AWSLogs/${AWS::AccountId}/*'
              Condition:
                StringEquals:
                  's3:x-amz-acl': 'bucket-owner-full-control'
  
    TrailLogGroup:
      Type: 'AWS::Logs::LogGroup'
      Properties:
        RetentionInDays: !Ref CloudWatchLogsRetentionInDays
  
    TrailLogGroupRole:
      Type: 'AWS::IAM::Role'
      Properties:
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: AssumeRole1
              Effect: Allow
              Principal:
                Service: 'cloudtrail.amazonaws.com'
              Action: 'sts:AssumeRole'
        PermissionsBoundary: !If [HasPermissionsBoundary, !Ref PermissionsBoundary, !Ref 'AWS::NoValue']
        Policies:
          - PolicyName: 'cloudtrail-policy'
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - 'logs:CreateLogStream'
                    - 'logs:PutLogEvents'
                  Resource: !GetAtt 'TrailLogGroup.Arn'
  
    TrailTopic:
      Type: 'AWS::SNS::Topic'
      Properties:
        KmsMasterKeyId: !If 
          - HasKmsKey
          - {'Fn::ImportValue': !Sub '${ParentKmsKeyStack}-KeyId'}
          - !Ref 'AWS::NoValue'
  
    TrailTopicPolicy:
      Type: 'AWS::SNS::TopicPolicy'
      Properties:
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Sid: AWSCloudTrailSNSPolicy
              Effect: Allow
              Principal:
                Service: 'cloudtrail.amazonaws.com'
              Resource: !Ref TrailTopic
              Action: 'sns:Publish'
        Topics:
          - !Ref TrailTopic
  
    Trail:
      Condition: InternalBucket
      DependsOn:
        - TrailBucketPolicy
        - TrailTopicPolicy
      Type: 'AWS::CloudTrail::Trail'
      Properties:
        IncludeGlobalServiceEvents: true
        IsLogging: true
        IsMultiRegionTrail: true
        EventSelectors: !If 
          - IsS3DataEvents
          - - DataResources:
                - Type: 'AWS::S3::Object'
                  Values: ['arn:aws:s3:::']
              IncludeManagementEvents: true
              ReadWriteType: All
          - !Ref 'AWS::NoValue'
        S3BucketName: !Ref TrailBucket
        S3KeyPrefix: !Ref LogFilePrefix
        EnableLogFileValidation: true
        CloudWatchLogsLogGroupArn: !GetAtt 'TrailLogGroup.Arn'
        CloudWatchLogsRoleArn: !GetAtt 'TrailLogGroupRole.Arn'
        SnsTopicName: !GetAtt 'TrailTopic.TopicName'
  
    ExternalTrail:
      Condition: ExternalBucket
      DependsOn:
        - TrailTopicPolicy
      Type: 'AWS::CloudTrail::Trail'
      Properties:
        IncludeGlobalServiceEvents: true
        IsLogging: true
        IsMultiRegionTrail: true
        EventSelectors: !If 
          - IsS3DataEvents
          - - DataResources:
                - Type: 'AWS::S3::Object'
                  Values: ['arn:aws:s3:::']
              IncludeManagementEvents: true
              ReadWriteType: All
          - !Ref 'AWS::NoValue'
        S3BucketName: !Ref ExternalTrailBucket
        S3KeyPrefix: !Ref LogFilePrefix
        EnableLogFileValidation: true
        CloudWatchLogsLogGroupArn: !GetAtt 'TrailLogGroup.Arn'
        CloudWatchLogsRoleArn: !GetAtt 'TrailLogGroupRole.Arn'
        SnsTopicName: !GetAtt 'TrailTopic.TopicName'
  
    # CIS 3.1
    UnauthorizedOperationMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*")}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'UnauthorizedOperationCount'
  
    UnauthorizedOperationAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: unauthorized API calls detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: UnauthorizedOperationCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.2
    NonMfaConsoleLoginMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = "ConsoleLogin") && ($.additionalEventData.MFAUsed != "Yes") && ($.userIdentity.type != "AssumedRole")}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'NonMfaConsoleLoginCount'
  
    NonMfaConsoleLoginAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: Management Console sign-in without MFA detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: NonMfaConsoleLoginCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.3
    RootUserActivityMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{$.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent"}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'RootUserActivityCount'
  
    RootUserActivityAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: usage of root account/user detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: RootUserActivityCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.4
    IamPolicyChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'IamPolicyChangeCount'
  
    IamPolicyChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: IAM policy changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: IamPolicyChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.5
    CloudTrailConfigChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = CreateTrail) || ($.eventName = UpdateTrail) || ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName = StopLogging)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'CloudTrailConfigChangeCount'
  
    CloudTrailConfigChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: CloudTrail configuration changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: CloudTrailConfigChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.6
    ManagementConsoleAuthFailureMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication")}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'ManagementConsoleAuthFailureCount'
  
    ManagementConsoleAuthFailureAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: Management Console authentication failures detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: ManagementConsoleAuthFailureCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.7
    DeletingKmsCmkMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'DeletingKmsCmkCount'
  
    DeletingKmsCmkAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: disabling or scheduled deletion of customer created CMKs detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: DeletingKmsCmkCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.8
    S3BucketPolicyChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventSource = s3.amazonaws.com) && (($.eventName = PutBucketAcl) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketReplication) || ($.eventName = DeleteBucketPolicy) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketReplication))}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'S3BucketPolicyChangeCount'
  
    S3BucketPolicyChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: S3 bucket policy changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: S3BucketPolicyChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.9
    ConfigChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventSource = config.amazonaws.com) && (($.eventName = StopConfigurationRecorder) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = PutDeliveryChannel) || ($.eventName = PutConfigurationRecorder))}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'ConfigChangeCount'
  
    ConfigChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: AWS Config configuration changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: ConfigChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # Single workload region logic for unauthorized operations outside this one region:
    UnauthorizedOperationRegionMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        LogGroupName: !Ref TrailLogGroup
        # We only compare against one region now.
        FilterPattern: !Join
          - ''
          - - '{ ($.eventType = "AwsApiCall") && ($.awsRegion != "'
            - !Ref WorkloadRegion
            - '") }'
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'UnauthorizedOperationRegionCount'
  
    UnauthorizedOperationRegionAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: Unauthorized Operation detected in non-allowed Region'
        Namespace: !Ref 'AWS::StackName'
        MetricName: UnauthorizedOperationRegionCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.10
    SecurityGroupChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'SecurityGroupChangeCount'
  
    SecurityGroupChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: security group changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: SecurityGroupChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.11
    NaclChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'NaclChangeCount'
  
    NaclChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: changes to Network Access Control List (NACL) detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: NaclChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.12
    NetworkGatewayChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'NetworkGatewayChangeChangeCount'
  
    NetworkGatewayChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: changes to network gateways detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: NetworkGatewayChangeChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.13
    RouteTableChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = CreateRoute) || ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRoute) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DisassociateRouteTable)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'RouteTableChangeCount'
  
    RouteTableChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: changes to route tables detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: RouteTableChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # CIS 3.14
    VpcChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink)}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'VpcChangeCount'
  
    VpcTableChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: changes to VPCs detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: VpcChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
    # Additional SecurityHub Alert Example
    SecurityHubConfigChangeMetricFilter:
      Condition: HasAlertTopic
      Type: 'AWS::Logs::MetricFilter'
      Properties:
        FilterPattern: '{($.eventSource = securityhub.amazonaws.com) && (($.eventName = DisableSecurityHub) || ($.eventName = DisassociateFromMasterAccount) || ($.eventName = DisassociateMembers))}'
        LogGroupName: !Ref TrailLogGroup
        MetricTransformations:
          - MetricValue: '1'
            MetricNamespace: !Ref 'AWS::StackName'
            MetricName: 'SecurityHubConfigChangeCount'
  
    SecurityHubConfigChangeAlarm:
      Condition: HasAlertTopic
      Type: 'AWS::CloudWatch::Alarm'
      Properties:
        AlarmDescription: 'CloudTrail: SecurityHub configuration changes detected'
        Namespace: !Ref 'AWS::StackName'
        MetricName: SecurityHubConfigChangeCount
        Statistic: Sum
        Period: 300
        EvaluationPeriods: 1
        ComparisonOperator: GreaterThanThreshold
        Threshold: 0
        AlarmActions:
          - {'Fn::ImportValue': !Sub '${ParentAlertStack}-TopicARN'}
        TreatMissingData: notBreaching
  
  Outputs:
    TemplateID:
      Description: 'Template id.'
      Value: 'cloudtrail'
    TemplateVersion:
      Description: 'Template version.'
      Value: '__VERSION__'
    StackName:
      Description: 'Stack name.'
      Value: !Sub '${AWS::StackName}'