Skip to content

Commit 4f12fdd

Browse files
Brian969Brian969
authored
Update-Control-Tower-example-config-for-v3.0 (#1027)
1 parent 21421b7 commit 4f12fdd

File tree

1 file changed

+22
-22
lines changed

1 file changed

+22
-22
lines changed

‎reference-artifacts/SAMPLE_CONFIGS/config.lite-CTNFW-example.json‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@
249249
"metrics": [
250250
{
251251
"filter-name": "SecurityGroupChangeMetric",
252-
"accounts": ["ALL"],
252+
"accounts": ["management"],
253253
"regions": ["${HOME_REGION}"],
254254
"loggroup-name": "aws-controltower/CloudTrailLogs",
255255
"filter-pattern": "{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }",
@@ -259,7 +259,7 @@
259259
},
260260
{
261261
"filter-name": "NetworkAclChangeMetric",
262-
"accounts": ["ALL"],
262+
"accounts": ["management"],
263263
"regions": ["${HOME_REGION}"],
264264
"loggroup-name": "aws-controltower/CloudTrailLogs",
265265
"filter-pattern": "{ ($.eventName = CreateNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation)}",
@@ -269,7 +269,7 @@
269269
},
270270
{
271271
"filter-name": "GatewayChangeMetric",
272-
"accounts": ["ALL"],
272+
"accounts": ["management"],
273273
"regions": ["${HOME_REGION}"],
274274
"loggroup-name": "aws-controltower/CloudTrailLogs",
275275
"filter-pattern": "{ ($.eventName = CreateCustomerGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = DetachInternetGateway)}",
@@ -279,7 +279,7 @@
279279
},
280280
{
281281
"filter-name": "VpcChangeMetric",
282-
"accounts": ["ALL"],
282+
"accounts": ["management"],
283283
"regions": ["${HOME_REGION}"],
284284
"loggroup-name": "aws-controltower/CloudTrailLogs",
285285
"filter-pattern": "{ ($.eventName = CreateVpc) || ($.eventName = DeleteVpc) || ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }",
@@ -289,7 +289,7 @@
289289
},
290290
{
291291
"filter-name": "Ec2InstanceChangeMetric",
292-
"accounts": ["ALL"],
292+
"accounts": ["management"],
293293
"regions": ["${HOME_REGION}"],
294294
"loggroup-name": "aws-controltower/CloudTrailLogs",
295295
"filter-pattern": "{ ($.eventName = RunInstances) || ($.eventName = RebootInstances)|| ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName= TerminateInstances) }",
@@ -299,7 +299,7 @@
299299
},
300300
{
301301
"filter-name": "Ec2LargeInstanceChangeMetric",
302-
"accounts": ["ALL"],
302+
"accounts": ["management"],
303303
"regions": ["${HOME_REGION}"],
304304
"loggroup-name": "aws-controltower/CloudTrailLogs",
305305
"filter-pattern": "{ (($.eventName = RunInstances) || ($.eventName = RebootInstances)|| ($.eventName = StartInstances) || ($.eventName = StopInstances) || ($.eventName= TerminateInstances)) && (($.requestParameters.instanceType= *.32xlarge) || ($.requestParameters.instanceType= *.24xlarge) || ($.requestParameters.instanceType= *.18xlarge) || ($.requestParameters.instanceType= *.16xlarge) || ($.requestParameters.instanceType= *.12xlarge) || ($.requestParameters.instanceType= *.10xlarge) || ($.requestParameters.instanceType= *.9xlarge) || ($.requestParameters.instanceType= *.8xlarge) || ($.requestParameters.instanceType = *.4xlarge)) }",
@@ -309,7 +309,7 @@
309309
},
310310
{
311311
"filter-name": "CloudTrailChangeMetric",
312-
"accounts": ["ALL"],
312+
"accounts": ["management"],
313313
"regions": ["${HOME_REGION}"],
314314
"loggroup-name": "aws-controltower/CloudTrailLogs",
315315
"filter-pattern": "{ ($.eventName = CreateTrail) || ($.eventName = UpdateTrail)|| ($.eventName = DeleteTrail) || ($.eventName = StartLogging) || ($.eventName= StopLogging) }",
@@ -319,7 +319,7 @@
319319
},
320320
{
321321
"filter-name": "ConsoleSignInFailureMetric",
322-
"accounts": ["ALL"],
322+
"accounts": ["management"],
323323
"regions": ["${HOME_REGION}"],
324324
"loggroup-name": "aws-controltower/CloudTrailLogs",
325325
"filter-pattern": "{ ($.eventName = ConsoleLogin) && ($.errorMessage = \"Failed authentication\") }",
@@ -329,7 +329,7 @@
329329
},
330330
{
331331
"filter-name": "AuthorizationFailureMetric",
332-
"accounts": ["ALL"],
332+
"accounts": ["management"],
333333
"regions": ["${HOME_REGION}"],
334334
"loggroup-name": "aws-controltower/CloudTrailLogs",
335335
"filter-pattern": "{ (($.errorCode = \"*UnauthorizedOperation\") || ($.errorCode =\"AccessDenied*\") && ($.userIdentity.principalId != \"*AWSConfig-BucketConfigCheck\")) }",
@@ -339,7 +339,7 @@
339339
},
340340
{
341341
"filter-name": "IamPolicyChangesMetric",
342-
"accounts": ["ALL"],
342+
"accounts": ["management"],
343343
"regions": ["${HOME_REGION}"],
344344
"loggroup-name": "aws-controltower/CloudTrailLogs",
345345
"filter-pattern": "{($.eventName=DeleteGroupPolicy)||($.eventName=DeleteRolePolicy)||($.eventName=DeleteUserPolicy)||($.eventName=PutGroupPolicy)||($.eventName=PutRolePolicy)||($.eventName=PutUserPolicy)||($.eventName=CreatePolicy)||($.eventName=DeletePolicy)||($.eventName=CreatePolicyVersion)||($.eventName=DeletePolicyVersion)||($.eventName=AttachRolePolicy)||($.eventName=DetachRolePolicy)||($.eventName=AttachUserPolicy)||($.eventName=DetachUserPolicy)||($.eventName=AttachGroupPolicy)||($.eventName=DetachGroupPolicy)}",
@@ -349,7 +349,7 @@
349349
},
350350
{
351351
"filter-name": "ConsoleSignInWithoutMfaMetric",
352-
"accounts": ["ALL"],
352+
"accounts": ["management"],
353353
"regions": ["${HOME_REGION}"],
354354
"loggroup-name": "aws-controltower/CloudTrailLogs",
355355
"filter-pattern": "{($.eventName=\"ConsoleLogin\") && ($.additionalEventData.MFAUsed !=\"Yes\") && ($.userIdentity.type != \"AssumedRole\")}",
@@ -359,7 +359,7 @@
359359
},
360360
{
361361
"filter-name": "RootLoginMetric",
362-
"accounts": ["ALL"],
362+
"accounts": ["management"],
363363
"regions": ["${HOME_REGION}"],
364364
"loggroup-name": "aws-controltower/CloudTrailLogs",
365365
"filter-pattern": "{ $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" }",
@@ -369,7 +369,7 @@
369369
},
370370
{
371371
"filter-name": "DisableOrDeleteCMKMetric",
372-
"accounts": ["ALL"],
372+
"accounts": ["management"],
373373
"regions": ["${HOME_REGION}"],
374374
"loggroup-name": "aws-controltower/CloudTrailLogs",
375375
"filter-pattern": "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}",
@@ -379,7 +379,7 @@
379379
},
380380
{
381381
"filter-name": "AWSConfigChangesMetric",
382-
"accounts": ["ALL"],
382+
"accounts": ["management"],
383383
"regions": ["${HOME_REGION}"],
384384
"loggroup-name": "aws-controltower/CloudTrailLogs",
385385
"filter-pattern": "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}",
@@ -389,7 +389,7 @@
389389
},
390390
{
391391
"filter-name": "RouteTableChangesMetric",
392-
"accounts": ["ALL"],
392+
"accounts": ["management"],
393393
"regions": ["${HOME_REGION}"],
394394
"loggroup-name": "aws-controltower/CloudTrailLogs",
395395
"filter-pattern": "{($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable)}",
@@ -399,7 +399,7 @@
399399
},
400400
{
401401
"filter-name": "S3BucketPolicyChangesMetric",
402-
"accounts": ["ALL"],
402+
"accounts": ["management"],
403403
"regions": ["${HOME_REGION}"],
404404
"loggroup-name": "aws-controltower/CloudTrailLogs",
405405
"filter-pattern": "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}",
@@ -409,7 +409,7 @@
409409
},
410410
{
411411
"filter-name": "SSOAuthUnapprovedIPMetric",
412-
"accounts": ["ALL"],
412+
"accounts": ["management"],
413413
"regions": ["${HOME_REGION}"],
414414
"loggroup-name": "aws-controltower/CloudTrailLogs",
415415
"filter-pattern": "{ ($.eventSource=sso.amazonaws.com) && ($.eventName=Authenticate) && ($.sourceIPAddress != ${ALARM-NOT-IP}) }",
@@ -419,7 +419,7 @@
419419
},
420420
{
421421
"filter-name": "IAMAuthUnapprovedIPMetric",
422-
"accounts": ["ALL"],
422+
"accounts": ["management"],
423423
"regions": ["${HOME_REGION}"],
424424
"loggroup-name": "aws-controltower/CloudTrailLogs",
425425
"filter-pattern": "{ ($.eventName=ConsoleLogin) && ($.userIdentity.type=IAMUser) && ($.sourceIPAddress != ${ALARM-NOT-IP}) }",
@@ -429,7 +429,7 @@
429429
},
430430
{
431431
"filter-name": "UnencryptedFilesystemCreatedMetric",
432-
"accounts": ["ALL"],
432+
"accounts": ["management"],
433433
"regions": ["${HOME_REGION}"],
434434
"loggroup-name": "aws-controltower/CloudTrailLogs",
435435
"filter-pattern": "{ ($.eventName = CreateFileSystem) && ($.responseElements.encrypted IS FALSE) } ",
@@ -439,7 +439,7 @@
439439
},
440440
{
441441
"filter-name": "IgnoreAuthorizationFailureMetric",
442-
"accounts": ["ALL"],
442+
"accounts": ["management"],
443443
"regions": ["${HOME_REGION}"],
444444
"loggroup-name": "aws-controltower/CloudTrailLogs",
445445
"filter-pattern": "{($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")}",
@@ -449,7 +449,7 @@
449449
},
450450
{
451451
"filter-name": "IgnoreConsoleSignInWithoutMfaMetric",
452-
"accounts": ["ALL"],
452+
"accounts": ["management"],
453453
"regions": ["${HOME_REGION}"],
454454
"loggroup-name": "aws-controltower/CloudTrailLogs",
455455
"filter-pattern": "{($.eventName=\"ConsoleLogin\") && ($.additionalEventData.MFAUsed !=\"Yes\")}",
@@ -459,7 +459,7 @@
459459
}
460460
],
461461
"alarms": {
462-
"default-accounts": ["ALL"],
462+
"default-accounts": ["management"],
463463
"default-regions": ["${HOME_REGION}"],
464464
"default-namespace": "CloudTrailMetrics",
465465
"default-statistic": "Sum",

0 commit comments

Comments
 (0)