Skip to content
Permalink
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
36 lines (35 sloc) 1.14 KB
AWSTemplateFormatVersion: 2010-09-09
Parameters:
CloudTrailLogGroup:
Type: String
Description: "The CloudWatch log group where CloudTrail writes the logs"
SNSTopic:
Type: String
Description: "The SNS topic to send notifications to"
Resources:
LoginMetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
LogGroupName: !Ref CloudTrailLogGroup
FilterPattern: '{$.errorCode = "AccessDenied"}'
MetricTransformations:
- MetricValue: 1
MetricNamespace: !Sub "${AWS::StackName}"
MetricName: AccessDenieds
AccessDeniedAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
ComparisonOperator: GreaterThanThreshold
EvaluationPeriods: 1
Threshold: 0
Namespace: !Sub "${AWS::StackName}"
MetricName: AccessDenieds
Statistic: Maximum
Period: 60
TreatMissingData: notBreaching
ActionsEnabled: true
AlarmActions:
- !Ref SNSTopic
Outputs:
LogsURL:
Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/cloudwatch/home#logEventViewer:group=${CloudTrailLogGroup};filter=%257B%2524.errorCode%2520%253D%2520%2522AccessDenied%2522%257D}"
You can’t perform that action at this time.