The metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws logs describe-metric-filters --query 'metricFilters[].{Filter:filterName,LogGroup:logGroupName,Pattern:filterPattern,Metric:metricTransformations[0].metricName}'$ aws cloudwatch describe-alarms --alarm-types MetricAlarm CompositeAlarm --query 'MetricAlarms[].{Name:AlarmName,Metric:MetricName,State:StateValue,Actions:AlarmActions}'$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudwatch-alarm-action-check --compliance-types NON_COMPLIANTExpected output
A metricFilters list showing each audit pattern you watch for and the metric it publishes, a matching alarm for each with a non-empty AlarmActions (the SNS topic or response action it fires), and an empty NON_COMPLIANT EvaluationResults set meaning no alarm is configured without an action. Managed rule identifier: CLOUDWATCH_ALARM_ACTION_CHECK
Map — what it proves
- recipe2
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:AU 11/27 →
GovCloud
CloudWatch, CloudWatch Logs, and AWS Config are available in AWS GovCloud (US); log-group, alarm, and SNS topic ARNs use partition arn:aws-us-gov
Notes & assertions
AU-06 asks that audit records be reviewed and analysed and findings reported; AU-06.01 asks that the review use automated mechanisms. What these calls prove is the automated half — the pipeline exists, it fires, and it reaches a human. No API proves a person read the alert, judged it, and reported the finding, so pair this with your ticket or case record; do not present an alarm list as a completed review. Metric filters only publish for events after the filter was created and are supported only on Standard-class log groups, so a filter created yesterday says nothing about last month. cloudwatch-alarm-action-check defaults to requiring an ALARM and INSUFFICIENT_DATA action; pass action1..action5 to assert alarms route to a specific SNS topic. Trail existence and protection is the separate cloudtrail recipe (AU-02/03/09/12).
References
- Creating metrics from log events using filters (CloudWatch Logs metric filters) https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html
- AWS CLI: logs describe-metric-filters https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html
- AWS CLI: cloudwatch describe-alarms https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html
- AWS Config managed rule: cloudwatch-alarm-action-check https://docs.aws.amazon.com/config/latest/developerguide/cloudwatch-alarm-action-check.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Monitoring, Logging, and Auditing run (7)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under MLA, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at restcontinuousconfig-cloudtrail-audit-loggingAWS Config · AWS CloudTrail · AWS KMS
- partialAWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findingscontinuousconfig-threat-monitoring-enabledAWS Config · Amazon GuardDuty · AWS Security Hub
- partialThe metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit reviewyou are hereweeklycloudwatch-log-review-alertingAmazon CloudWatch Logs · Amazon CloudWatch · AWS Config
- partialHow long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fieldsdailyaudit-log-retention-and-delivery-failureAmazon CloudWatch Logs · Amazon S3 · AWS CloudTrail · AWS Config · Amazon CloudWatch
- partialWhat each instance's clock is actually locked to and how far off it is right now — the chrony daemon's reference source, offset and leap status collected fleet-wide through Run Command — together with the configured time source in chrony.conf and the UTC time stamps CloudTrail already writes on every audit recorddailyclock-synchronization-and-timestampsAmazon EC2 · AWS Systems Manager · AWS CloudTrail
- partialA demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returnedquarterlyaudit-reduction-and-report-generationAmazon CloudWatch Logs · AWS CloudTrail · Amazon Athena · Amazon S3
- partialFor each artifact actually running in the boundary, the cryptographic answer to whether it came from the build this provider claims built it: the signed provenance statement, the certificate identifying the workflow that produced it, and the transparency-log timestamps that make the signature checkable later. Collected alongside the two things that decide whether that answer can be trusted at all — the version of the verifying client, and the record of which deployed artifacts were submitted for verification in the first place.on-changebuild-provenance-attestation-verificationGitHub artifact attestations