A company requires a real-time security monitoring and alerting solution to detect when any IAM user logs in to the AWS Management Console without using Multi-Factor Authentication (MFA). A SysOps Administrator must configure a solution that sends an email notification to the security team immediately upon detection.
Which two actions must the SysOps Administrator perform to meet these requirements?
- Create an Amazon EventBridge rule in the us-east-1 Region with an event pattern that matches the source aws.signin, the event name ConsoleLogin, and additionalEventData.MFAUsed set to No.Answer
- Configure the Amazon EventBridge rule to target an Amazon SNS topic that is subscribed to by the security team.Answer
- CCreate the Amazon EventBridge rule in the company's primary operational Region to capture regional ConsoleLogin events.
- DEnable CloudWatch detailed monitoring for the IAM service to increase metric granularity and capture authentication events.
- EConfigure an AWS Config custom rule to monitor ConsoleLogin API calls and set the rule's remediation action to publish directly to the SNS topic.
Answer
Creating an Amazon EventBridge rule in the us-east-1 Region that matches the ConsoleLogin event with MFAUsed set to No, and configuring the EventBridge rule to target an Amazon SNS topic subscribed to by the security team.
Console login is a global AWS service event, which is always routed to the default EventBridge event bus in the us-east-1 Region. To capture sign-in events without MFA, the EventBridge rule must be created in us-east-1 with a pattern matching ConsoleLogin where MFAUsed is set to No. The rule must target an Amazon SNS topic to immediately notify the security team.
Step-by-Step Solution
Key Concept
Monitoring global authentication events using Amazon EventBridge in the us-east-1 Region and routing them to Amazon SNS for real-time alerting.