Clean up security hub / config alerts

[davidkelliott]

User Story

We currently have security hub alerts which go off on pager duty. We need to look at these alerts and either resolve the underlying issue, or silence them and add a more reasonable alert.

For example security hub requires any failed login attempts to raise an alert. This happens occasionally and we don't need to know about this. We have to keep the original alert for security hub compliance, but we could mute that alert on pager duty and create a more useful one, such as 5 failed login attempts in a 1min period.

Value

Have alerts that when they go off we know we need to do something.

Questions / Assumptions

Definition of done

• timebox for 1 week maximum
• review current alerts from security hub
• if alert is not valid, suppress the alert
• if new ticket required to suppress raise that ticket

Reference

How to write good user stories

[github-actions]

This issue is stale because it has been open 90 days with no activity.

[markgov]

found two alarms that are going off the first one is
sign-in-failures GreaterThanOrEqualToThreshold 1.0 and the second is
unauthorised-api-calls GreaterThanOrEqualToThreshold 1.0
found a third
security-group-changes GreaterThanOrEqualToThreshold 1.0

[markgov]

ministryofjustice/modernisation-platform-terraform-baselines#498
PR submitted

[markgov]

PR merged and new release created will monitor alerts

[markgov]

#7376
Pr to update to the latest version

[markgov]

created an issue for an error that has been found

[markgov]

New Release created with new base count of 10 instances

[markgov]

New Cloud watch alarms
#7450