Introduction to Amazon CloudWatch

Monitor Resources and Applications 
We want to encourage you to use Amazon CloudWatch to its full potential. We rarely see AWS customers maximizing their use of this service to monitor all AWS resources and applications in real time. Simply stated by AWS, “With CloudWatch, you gain system-wide visibility into resource utilization, application performance, and operational health.”

Are you leveraging the following features?  
  • Collect, store, and aggregate logs 
  • Monitor through customizable dashboards and alarms 
  • Act on changes, alarms, and incidents through automation and Auto Scaling
  • Analyze trends, metrics, logs, and traces 
  • Achieve further compliance and security by integrating CloudWatch with AWS IAM

To begin maximizing your utilization of Amazon CloudWatch, start with learning about the dashboards.

Transcription 
Everyone should know how to use CloudWatch if they're using AWS. CloudWatch is a tool that provides insight into all of your resources regarding performance, utilization, and overall health. It also has a handy dashboard that has generic displays regarding those metrics. It's customizable, though, and you can change that to suit whatever your business needs are.
 
However, in audits, I rarely see CloudWatch being used to its full potential. CloudWatch can integrate with a number of other services that we discuss to create alerts regarding not only their performance, but also security related issues and changes in your environment. I hope that clients will take it upon themselves to learn more about this tool.

Related Videos

10.6.1 – Review Daily All Security Events and Logs of All System Components.mp4
10.6.2 – Review Logs of All Other System Components Based Policies and Risk Management Strategy
10.6.3 –Follow Up Exceptions and Anomalies Identified During the Review Process
5 Benchmarks of Role-Based Access Control Service Accounts
AWS Controls for Implementing a DMZ
AWS Firewall Manager Centralized Logging
AWS Functions to Restrict Database Access
AWS Incident Response Playbook
AWS Password Best Practices
AWS Password Expiration Policies
AWS Password Reuse Policy
AWS Tools for Your SDLC
Access Control Using IAM Instance Roles
Achieving High Availability in AWS
Antivirus Solutions on EC2 Instances
Assign Access Based on Business Need to Know
Assigning Information Security Management Responsibility
Attaching IAM Policies to Groups or Roles
Attributes of Log Data
Audit Trail Review with Kibana, Athena, and GuardDuty
Audit Your Security Groups for Insecure Ports and Protocols
Avoid Use of the Root Account
Basic Tools for AWS Security
Basics of Role Assumption
Best Practices for Change Management in AWS
Best Practices for Container Security
Best Practices for Password Parameters
Best Practices for Secret Management
Change-Detection Solutions in AWS
Cloud Attacks on the Rise
CloudTrail and CloudWatch Integration
Configure Activity Log Container Access to Private
Configure Storage Accounts to Use Customer Managed Keys
Configuring Network Border Controls
Connect Your AWS Account Using CloudFormation
Create Activity Log Alert for Delete SQL Server Firewall
Create an Activity Log Alert for Create or Update Public IP Address
Create an Activity Log Alert for Delete Security Solution
Creating a Compliant Incident Response Plan
Creating a Data Flow Diagram
Creating a Network Diagram
Define Acceptable Use of Technology Part 1
Defining Business Continuity and Disaster Recovery
Defining Resources in IAM Policies
Defining Resources in S3 Bucket Policies
Defining Roles and Responsibilities in AWS
Deploying Security Patches on EC2 Instances
Developing a Process for User Authentication
Disabling Insecure Ports and Protocols
Disabling Unused Credentials
Do All Keys Have Resources Attached?
Documenting a Systems Inventory in AWS
Does AWS Provide Vendor Defaults?
EC2 Instances in Availability Zones
Enable Access Transparency to Monitor Google Cloud Engineer Access
Enable Alerting for Cloud Storage IAM Permission Changes
Enable Bucket Lock to Protect Sink Destinations from Modification
Enable Cloud Audit Logging Across Your Project
Enable Cloud DNS Logging for VPC Networks
Enable Logging of Read, Write, and Delete Requests for Blob Service
Enable Logging of Read, Write, and Delete Requests for Table Service
Enable Maintenance and Backups for RDS
Enable Queue Storage Logging for Read Write Access
Enabling AWS Config in All Regions
Enabling CloudTrail Log File Validation
Enabling CloudTrail in All Regions
Enabling MFA for All IAM Users
Encrypt Kubernetes Secrets Using Keys
Encrypting Traffic In and Out of AWS
Encryption Decisions for Your Technology Stack
Encryption Opportunities
Encryption for EBS Volumes
Encryption for S3 Buckets
Enforce Separation with Access Controls
Enforcing Strong Encryption in AWS
Enforcing Strong TLS Ciphers
Ensure ALBs Have WAF ACLs Attached
Ensure Alerts Exist for Project Ownership Changes
Ensure Alerts are Received for VPC Network Changes
Ensure Container Network Interfaces Support Network Policies
Ensure Diagnostic Setting Captures Appropriate Categories
Ensure GKE Nodes are Configured Properly
Ensure Log Alert Exists for Create or Update Network Security Group
Ensure Logging for AppServiceHTTPLogs
Ensure Network Security Group Flow Logs Are Sent to Log Analytics
Ensure RDS Instances are Only Accessible by Internal IPs
Ensure That a Diagnostic Setting Is Enabled
Ensure an Activity Log Alert Exists for Delete Public IP Address
Ensuring Role Assumption is Logged
Establish a Log Metric Alert for Configuration Changes in SQL Instances
Events that Drive Key Rotation
FAQs for Amazon S3 Security
Filters and Alarms in CloudWatch
GKE Authentication and Authorization Best Practices
GKE Cluster Configuration Security Benchmarks
General Policies for Cluster Management
Generate Log Metric Alerts for Custom Role Changes
GuardDuty Alerts for Control Failures
Historically View Project Resources in Asset Inventory
House Accounts in CloudTrail
How To Configure Your Cluster Networks
How to Attach IAM Policies to Groups or Roles
How to Check MFA in a Credential Report
How to Check Use of the Root Account
How to Configure Encryption for EBS Volumes on Existing EC2 Instances
How to Configure Encryption for EBS Volumes on New EC2 Instances
How to Configure Encryption for RDS
How to Configure Encryption for S3 Buckets
How to Edit Inbound Traffic Rules for Default Security Groups
How to Find Administrative Privileges in IAM Policies
How to House Multiple Accounts Within an AWS Organization
How to Modify Password Complexity in a Password Policy
How to Modify Permissions to EBS Snapshots
How to Prevent Password Reuse in a Password Policy
How to Restrict Public Access to S3 Buckets
How to Use S3 Bucket Policies
How to Use S3 Versioning and Lifecycle Rules
IAM Policies for Account Authentication
IAM Policies that Address Administrative Privileges
Identify Unrestricted Access to Ports for Security Groups
Identify if EC2 Instances Are Directly Connected to the Internet
Identifying Assets, Threats, and Vulnerabilities
Identifying Unused Credentials in a Credential Report
Identifying and Ranking Vulnerabilities in AWS
Identity and Access Management Benchmarks in GKE
Image Registry and Scanning Best Practices
Industry Best Practices for Configuration Standards
Introduction to AWS Network Firewall
Introduction to AWS Security Hub
Introduction to AWS WAF and Shield
Introduction to Amazon Detective
Introduction to Amazon EKS
Introduction to Amazon Inspector
Introduction to Amazon S3 Access Points
Introduction to IAM Access Analyzer
Key Rotation and Management
Leverage Google Cloud Engineers by Granting Access Approval
Load Balancers Must Require TLS 1.2
Log and Retain All Relevant Activities
Logging Tools in AWS
Logging Web ACL Data in Amazon Kinesis
MFA for API Calls
Meeting Firewall and Router Configuration Standards
Meeting Your Baseline with Patch Manager
Monitor Network Traffic with VPC Flow Logs
Monitor Your Environment with Network Watcher
Monitor for "Delete Network Security Groups" Through Log Alerts
Network Segmentation for AWS
Node MetaData Recommendations in GKE
PCI Requirement 10 – Track and Monitor all Access to Network Resources and Cardholder Data
PCI Requirement 10.1 – Implement Audit Trails to Link all Access to System Components
PCI Requirement 10.2 – Implement Automated Audit Trails for all System Components
PCI Requirement 10.2.1 – All Individual User Accesses to Cardholder Data
PCI Requirement 10.2.2 – All Actions Taken by Any Individual with Root or Administrative Privileges
PCI Requirement 10.2.3 – Access to All Audit Trails
PCI Requirement 10.2.4 – Invalid Logical Access Attempts.mp4
PCI Requirement 10.2.5 – Use of and Changes to Identification Accounts with Root Privileges
PCI Requirement 10.2.6 – Initialization, Stopping, or Pausing of the Audit Logs
PCI Requirement 10.2.7 – Creation and Deletion of System-Level Objects
PCI Requirement 10.3 – Record at Least the Following Audit Trail Entries for All System Components
PCI Requirement 10.3.1 – User Identification
PCI Requirement 10.3.2 – Type of Event
PCI Requirement 10.3.3 – Date and Time
PCI Requirement 10.3.4 – Success or Failure Indication
PCI Requirement 10.3.5 – Origination of Event
PCI Requirement 10.3.6 – Identity or Name of Affected Data, System Component, or Resource
PCI Requirement 10.4 – Using Time-Synchronization Technology, Synchronize All Critical Systems
PCI Requirement 10.4.1 – Critical Systems Have the Correct and Consistent Time
PCI Requirement 10.4.2 – Time Data is Protected
PCI Requirement 10.4.3 – Time Settings Are Received from Industry-Accepted Time Sources
PCI Requirement 10.5 – Secure Audit Trails so They Cannot Be Altered
PCI Requirement 10.5.1 – Limit Viewing of Audit Trails to Those with a Job-Related Need
PCI Requirement 10.5.2 – Protect Audit Trail Files from Unauthorized Modifications
PCI Requirement 10.5.3 – Promptly Back Up Audit Trail Files to a Centralized Log Server
PCI Requirement 10.5.4 – Write Logs for External-Facing Technologies onto a Secure Device
PCI Requirement 10.5.5 – Use File-Integrity Monitoring or Change-Detection Software on Logs
PCI Requirement 10.6 – Review Logs and Security Events for All System Components
PCI Requirement 10.7 – Retain Audit Trail History for at Least One Year, with Three Months Available
PCI Requirement 10.8 –Implement a Process for the Detection of Failures of Critical Control Systems
PCI Requirement 10.8.1 –Respond to Failures of Any Critical Security Controls in a Timely Manner
PCI v4.0 - 10.1.1: Requirement 10 Policies and Procedures Are In Place
PCI v4.0 - 10.1.2: Requirement 10 Roles and Responsibilities Are In Place
PCI v4.0 - 10.2.1.1: Logs Capture Individual User Access to Cardholder Data
PCI v4.0 - 10.2.1.2: Logs Capture All Actions by Someone with Administrative Access
PCI v4.0 - 10.2.1.3: Logs Capture All Access to Audit Logs
PCI v4.0 - 10.2.1.4: Logs Capture All Invalid Logical Access Attempts
PCI v4.0 - 10.2.1.5: Logs Capture All Changes to Identification and Authentication Credentials
PCI v4.0 - 10.2.1.6: Logs Capture All Initialization Starting Stopping and Pausing of Audit Logs
PCI v4.0 - 10.2.1.7: Logs Capture All Creation and Deletion of System Level Objects
PCI v4.0 - 10.2.1: Audit Logs Are Enabled and Active
PCI v4.0 - 10.2.2: Audit Logs Record All Appropriate Information for Each Auditable Event
PCI v4.0 - 10.3.1: Read Access to Audit Log Files Is Limited
PCI v4.0 - 10.3.2: Audit Log Files Are Protected from Modification
PCI v4.0 - 10.3.3: Audit Log Files Are Properly Backed Up
PCI v4.0 - 10.3.4: Utilize File Integrity Monitoring or Change-Detection Tools on Audit Logs
PCI v4.0 - 10.4.1 & 10.4.1.1: Perform Specific Daily Audit Log Reviews Using Automated Mechanisms
PCI v4.0 - 10.4.2 & 10.4.2.1: Periodically Perform Other Audit Log Reviews
PCI v4.0 - 10.4.3: Address Identified Exceptions and Anomalies
PCI v4.0 - 10.5.1: Retain Audit Log History for At Least 12 Months
PCI v4.0 - 10.6.1: System Clocks and Time Are Synchronized
PCI v4.0 - 10.6.2: Systems Are Configured to the Correct and Consistent Time
PCI v4.0 - 10.6.3: Time Synchronization Settings and Data Are Protected
PCI v4.0 - 10.7.1: (Service Providers) Critical Security Control System Failures Are Addressed
PCI v4.0 - 10.7.2: Failure of Critical Security Control Systems Are Handled Appropriately
PCI v4.0 - 10.7.3: Failure of Any Critical Security Controls Are Promptly Addressed
PCI v4.0 - A1.2.1: (Multi-Tenant Service Providers) Ensure Appropriate Logging Is Enabled
Penetration Testing for AWS Segmentation Controls
Performing Code Review Prior to Release
Performing a BIA for AWS
Physical Security Responsibilities for AWS
Physical Security Responsibilities for AWS Users
Physical Threats for AWS
Pods Security Policies Benchmarks
Prevent Shared, Group, or Generic Accounts in AWS
Preventing Public Accessibility on DB Instances
Preventing Publicly Available CloudTrail Logs
Preventing Publicly Available S3 Buckets
Protect Against Threats With Extensible Admission Control
Protecting API Gateways with WAF Rules
Protecting CloudTrail Logs
Protecting Web Applications in AWS
Publish and Maintain an Information Security Policy
Quarterly Reviews of Your Security Program
Re-Keying for Decryption
Receive Alerts for Audit Configuration Changes
Receive Alerts for VPC Network Firewall Rule Changes
Restrict Access to CloudTrail Logs in S3 Buckets
Restrict Security Group Access to All Ports
Restricting Access to EBS Snapshots
Retaining Your Audit Trail in AWS
Reviewing Firewall and Router Configurations
Rotating Access Keys
Route 53 Support for DNSSEC
Routing Outbound Traffic Through NAT Gateways
Running Vulnerability Scans After a Significant Change
Secure Code Development in AWS
Securing Your Log Files
Security Awareness Training for CHD Policies
Separation of Duties in Penetration Testing
Shared Responsibility Matrix in PCI
Support MFA through IAM Policies
Systems Manager Maintenance
Testing Your Business Continuity and Disaster Recovery Plans
Testing for Unauthorized Wireless Access Points
The AWS Shared Responsibility Model
The Difference Between NACLs and Security Groups
The Value of Quarterly Internal Vulnerability Scans
Top 10 AWS Mistakes
Understanding the "Deny All" Function
Use CMEK To Secure GKE Storage
Use Cloud Logging Sinks to Retain Logs
Using AWS KMS
Using Amazon Time Sync Service
Using IAM Instance Roles for AWS Resource Access
Using IAM Policies
Using OWASP's Kubernetes Cheat Sheet
Using Prowler to Evaluate AWS Security
Using S3 Versioning
Using Systems Manager from a Service-Linked Role
Using TLS 1.2 to Encrypt Data in Transit
Using VPC Endpoints to Access Systems Manager
Using a Bastion Host or Session Manager to Limit Access to Port 22
Using an ASV for External Vulnerability Scans
Utilize Flow Logs to Log Traffic in Your Environment
Utilize Log Alerts for Create or Update SQL Server Firewall
Utilize Log Alerts for Create or Update Security Solution
Utilize Logging for Azure Key Vault
VPC Network Route Changes Should Trigger Alerts
Verify Log Alert Exists for Create Policy Assignment
Verify Log Alert Exists for Delete Policy Assignment
When to Use S3 Access Control Lists
Your Data Backup Strategy in AWS