Console Sign-in Failures Alarm

01 Sign in to the AWS Management Console.

02 Navigate to SNS dashboard at https://console.aws.amazon.com/sns/v2/.

03 In the left navigation panel, select Topics and click the Create new topic button.

04 In the Create new topic dialog box, enter a name and a display name (optional) for the topic and click Create Topic.

05 Select the newly created SNS topic by clicking on its ARN name:

06 Under Subscription section, click Create Subscription.

07 Select Email as subscription protocol from the Protocol dropdown list.

08 Enter the email address where to receive the alarm notifications and click Create Subscription.

09 Use your email client application and open the message from AWS Notifications, then click on the appropriate link to confirm your subscription.

01 Run create-topic command (OSX/Linux/UNIX) to create a new SNS topic for sending email notifications:

aws sns create-topic
	--name MySNSTopic

02 The command output should return the new SNS topic ARN (Amazon Resource Name):

{
    "TopicArn": "arn:aws:sns:us-east-1:123456789012:MySNSTopic"
}

03 Run subscribe command (OSX/Linux/UNIX) to send the subscription confirmation message to the notification-endpoint (in this case the endpoint is your email address):

aws sns subscribe
	--topic-arn arn:aws:sns:us-east-1:123456789012:MySNSTopic
	--protocol email
	--notification-endpoint admin@domain.com

04 Run confirm-subscription command (OSX/Linux/UNIX) to confirm the subscription by validating the token sent to the notification endpoint selected (the command does not return an output):

aws sns confirm-subscription
	--topic-arn arn:aws:sns:us-east-1:123456789012:MySNSTopic
	--token 9655392f37fb687f5d51e6e241d7700ae02f7124d8268910b858cb4db727ceeb2474bb937929d3bdd7ce5d0cce19325d036bc858d3c217426bcafa9c501a2cace93b83f1dd3797627467553dc438a8c974119496fc3eff026eaa5d14472ded6f9a5c43aec62d83ef5f49109da715653

01 Sign in to the AWS Management Console.

02 Navigate to Cloudwatch dashboard at https://console.aws.amazon.com/cloudwatch/.

03 In the left navigation panel, select Logs.

04 Select the log group created for your CloudTrail trail event logs and click Create Metric Filter button.

05 On the Define Logs Metric Filter page, click inside the Filter Pattern box and type the following pattern: { ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }. This will be used for scanning the CloudTrail logging data for strings like “Failed authentication”.

06 Review the metric filter details and click Assign Metric.

07 On the Create Metric Filter and Assign a Metric page, in the Filter Name box, enter a name for the filter name, e.g. AWSConsoleSignInFailures.

08 For the Metric Details section, provide the following information:

1. In the Metric Namespace box, type CloudTrailMetrics.
2. In the Metric Name box, type ConsoleSigninFailureCount for the metric identifier.
3. Click Show advanced metric settings to toggle advanced settings section.
4. In the Metric Value box, enter 1. Each occurrence of “Failed authentication” will increase the value of the metric by 1.

09 Review the metric details and click Create Filter.

10 On the current page, click Create Alarm:

11 In the Create Alarm dialog box, define the following:

1. In the Alarm Threshold section, enter a unique name (e.g. Console Sign-in Failures) in the Name box and a short description for the alarm in the Description box.
2. Under Whenever: <Metric Name>, select >= (greater than or equal to) from the is dropdown list and enter 3 as the threshold value for the sign-in failures in the box next to the dropdown list: .
3. In the Actions section, click the + Notification button, select State is ALARM from the Whenever this alarm dropdown menu and choose the AWS SNS topic name created at Step 1 from the Send notification to dropdown list.
4. In the Alarm Preview section, select 5 Minutes from the Period dropdown list and Sum from the Statistic dropdown list: .
5. Review the CloudWatch alarm configuration details then click Create Alarm. Once created, the alarm will be available on the CloudWatch Alarms page.

01 Run put-metric-filter command (OSX/Linux/UNIX) to create the CloudWatch metric filter and associate it with the appropriate CloudTrail log group (the command does not return an output):

aws logs put-metric-filter
	--region us-east-1
	--log-group-name CloudTrail/MyCloudTrailLG
	--filter-name AWSConsoleSignInFailures
	--filter-pattern '{ ($.eventName = ConsoleLogin) && ($.errorMessage = "Failed authentication") }'
	--metric-transformations metricName=ConsoleSigninFailureCount,metricNamespace=CloudTrailMetrics,metricValue=1

02Run put-metric-alarm command (OSX/Linux/UNIX) to create the required CloudWatch alarm (if successful, the command does not return an output):

aws cloudwatch put-metric-alarm
	--region us-east-1
	--alarm-name "Console Sign-in Failures"
	--alarm-description "AWS Management Console Sign-in Failure Alarm."
	--metric-name ConsoleSigninFailureCount
	--namespace CloudTrailMetrics
	--statistic Sum
	--comparison-operator GreaterThanOrEqualToThreshold
	--evaluation-periods 1
	--period 300
	--threshold 3
	--actions-enabled
	--alarm-actions arn:aws:sns:us-east-1:123456789012:MySNSTopic