1

I want to monitor the change in security group of an EC2 instance using CloudWatch Events. So, used API call via CloudTrail as the event type.

Typically, CloudTrail delivers an event within 15 minutes of the API call which would hinder the near real-time Security group change monitor?

How can I improve this?

(https://aws.amazon.com/cloudtrail/faqs/).

Chris Williams
  • 32,215
  • 4
  • 30
  • 68
Abhishek Verma
  • 73
  • 7

1 Answers1

1

You're correct that there is a delay for CloudTrail events, some API calls are now integrated directly to hook into CloudWatch events whenever there is that action to get around this.

I believe you can use AWS config rules to validate in near-real time, there are rules such as ec2-security-group-attached-to-eni to monitor when a new security group is appended and restricted-common-ports to check if ports are open to the world.

If that solution does not work, you would need to develop your own solution to scan your resources unfortunately. Hopefully AWS will add more hooks over time for native integration vs CloudTrail integration.

Chris Williams
  • 32,215
  • 4
  • 30
  • 68
  • Hey Chris, all the config API activity, including use of AWS Config APIs to read configuration data, is logged by CloudTrail. So, that's again a bummer! – Abhishek Verma Jun 18 '20 at 11:57