# The metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit review

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/cloudwatch-log-review-alerting

Recipe id: `cloudwatch-log-review-alerting` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-MLA-RVL`
- control `au-6`
- control `au-6.1`

## Collection

Kind: `cli`

```sh
# describe-metric-filters
aws logs describe-metric-filters --query 'metricFilters[].{Filter:filterName,LogGroup:logGroupName,Pattern:filterPattern,Metric:metricTransformations[0].metricName}'
# describe-alarms
aws cloudwatch describe-alarms --alarm-types MetricAlarm CompositeAlarm --query 'MetricAlarms[].{Name:AlarmName,Metric:MetricName,State:StateValue,Actions:AlarmActions}'
# cloudwatch-alarm-action-check
aws configservice get-compliance-details-by-config-rule --config-rule-name cloudwatch-alarm-action-check --compliance-types NON_COMPLIANT
```

## Expected output

A metricFilters list showing each audit pattern you watch for and the metric it publishes, a matching alarm for each with a non-empty AlarmActions (the SNS topic or response action it fires), and an empty NON_COMPLIANT EvaluationResults set meaning no alarm is configured without an action. Managed rule identifier: CLOUDWATCH_ALARM_ACTION_CHECK

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

CloudWatch, CloudWatch Logs, and AWS Config are available in AWS GovCloud (US); log-group, alarm, and SNS topic ARNs use partition arn:aws-us-gov

## Notes

AU-06 asks that audit records be reviewed and analysed and findings reported; AU-06.01 asks that the review use automated mechanisms. What these calls prove is the automated half — the pipeline exists, it fires, and it reaches a human. No API proves a person read the alert, judged it, and reported the finding, so pair this with your ticket or case record; do not present an alarm list as a completed review. Metric filters only publish for events after the filter was created and are supported only on Standard-class log groups, so a filter created yesterday says nothing about last month. cloudwatch-alarm-action-check defaults to requiring an ALARM and INSUFFICIENT_DATA action; pass action1..action5 to assert alarms route to a specific SNS topic. Trail existence and protection is the separate cloudtrail recipe (AU-02/03/09/12).

## References

- {"title":"Creating metrics from log events using filters (CloudWatch Logs metric filters)","url":"https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html"}
- {"title":"AWS CLI: logs describe-metric-filters","url":"https://docs.aws.amazon.com/cli/latest/reference/logs/describe-metric-filters.html"}
- {"title":"AWS CLI: cloudwatch describe-alarms","url":"https://docs.aws.amazon.com/cli/latest/reference/cloudwatch/describe-alarms.html"}
- {"title":"AWS Config managed rule: cloudwatch-alarm-action-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudwatch-alarm-action-check.html"}