Browse the Repo

file-type-icon.circleci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconmodules
file-type-iconaws-securityhub
file-type-iconcloudtrail
file-type-iconcloudwatch-logs-metric-filters
file-type-iconimages
file-type-iconREADME.adoc
file-type-iconcore-concepts.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconiam-groups
file-type-iconiam-password-policy
file-type-iconsaml-iam-roles
file-type-iconrfcs
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconCONTRIBUTING.md
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconsetup.cfg

Browse the Repo

file-type-icon.circleci
file-type-icon_docs
file-type-iconcodegen
file-type-iconexamples
file-type-iconmodules
file-type-iconaws-securityhub
file-type-iconcloudtrail
file-type-iconcloudwatch-logs-metric-filters
file-type-iconimages
file-type-iconREADME.adoc
file-type-iconcore-concepts.md
file-type-iconmain.tf
file-type-iconoutputs.tf
file-type-iconvariables.tf
file-type-iconcross-account-iam-roles
file-type-iconcustom-iam-entity
file-type-iconiam-groups
file-type-iconiam-password-policy
file-type-iconsaml-iam-roles
file-type-iconrfcs
file-type-icontest
file-type-icon.gitignore
file-type-icon.pre-commit-config.yaml
file-type-iconCODEOWNERS
file-type-iconCONTRIBUTING.md
file-type-iconLICENSE.txt
file-type-iconREADME.adoc
file-type-iconsetup.cfg
CIS Foundations Benchmark

CIS Foundations Benchmark

Modules and utilities certified by Gruntwork and CIS to comply with the CIS AWS Foundations Benchmark

Code Preview

Preview the Code

mobile file icon

core-concepts.md

down

CloudWatch Logs Metrics Filters Core concepts

Configuration

Set the following variables to configure the module:

  • aws_region: Set this to the region where the metrics and alarms should be created.
  • cloudwatch_logs_group_name: Set this to the name of a CloudWatch Logs group used by CloudTrail.
  • sns_topic_already_exists: If you already have an SNS topic you'd like to use, set this to true and set the sns_topic_arn variable.
  • sns_topic_name: If sns_topic_already_exists is false, set this variable to a sensible value. The module will configure all the Benchmark alarms to use this topic.
  • sns_topic_arn: If sns_topic_already_exists is true, set this variable to the ARN of the topic.

The module does not create SNS topic subscriptions. If you're using Slack, we recommend the sns_to_slack Lambda function.

Questions? Ask away.

We're here to talk about our services, answer any questions, give advice, or just to chat.

Ready to hand off the Gruntwork?