3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA

Real-time monitoring of API calls can be achieved by directing CloudTrail Logs to CloudWatch Logs and establishing corresponding metric filters and alarms. It is recommended that a metric filter and alarm be established for console logins that are not protected by multi-factor authentication (MFA).

Type: [Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark]

Compliance Status: FAILED

Product Name: N/A

Company Name: N/A

Generator Id: arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.2

Record State: ACTIVE

Workflow Status: NEW

Workflow State: NEW

Account Id: 012345678912

Region: N/A

Source URL: N/A

Resource: [ { "Type" : "AwsAccount", "Id" : "AWS::::Account:012345678912", "Partition" : "aws", "Region" : "us-east-1" } ]

Mitigation: For directions on how to fix this issue, please consult the AWS Security Hub CIS documentation. https://docs.aws.amazon.com/console/securityhub/standards-cis-3.2/remediation

Finding Id : [14048736|https://preprod.armorcode.ai/#/findings/146/677/14048736]

teerth04 / ticket

3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA #1235