Monitoring Sign-in for AWS Accounts

CloudWatch can capture any AWS sign-in events, and you can configure response using either Alarms or Rules.

Alarms can keep track of the number of failed logins, but Rules are useful when you need an immediate response or if you have an external SIEM system.

There is a great article from TrendMicro on how to configure CloudWatch Alarms. In this post I will explain how to configure CloudWatch Rules.

Note:

1. A Rule needs to be configured only in us-east-1 region to capture Sign-in events.
2. A Rule needs to be configured for every account in AWS Organizations (even with CloudTrail logging to central location - CloudWatch cannot catch them from another account). You can create a target per rule per account, or push events to Master or Shared account Event Bus, and configure target there.

Steps:

1. Create a Rule as per instructions here.

2. Specify the pattern as
   {
"source": [
"aws.signin"
]
}

1. Specify Target (SNS topic "Email" is selected as example). Note that many AWS services can be configured as targets, for details see this article.

1. Click "Configure Details", add Rule name and description, and set Rule state to Enabled

1. Click "Create Rule".

2. Configure the same rule in other accounts, creating either SNS topic, or pushing event to Event Bus in Master or Shared Account

In summary, a Sign-in event Rule provides you with options to perform operations based on event details and helps you build your desired workflow.