Terraform AWS CloudWatch

Log groups, metric alarms, dashboards, retention settings, subscription filters, and event rules used for monitoring, alerting, forensic visibility, and audit support.

Quick start

module "cloudwatch" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "cloudwatch" {
  source  = "terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"
}

module "cloudwatch" {
  source  = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "~> 5.7"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "cloudwatch" {
  source  = "terraform-aws-modules/cloudwatch/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 4 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
CloudWatch alarms should have an action configured	Low
CloudWatch alarms should have action enabled	Low
CloudWatch log groups should have retention period of at least 365 days	Low
Log groups should have encryption at rest enabled	Low

Mapped compliance frameworks

Clause	Controls from this module
DE.DP-4	CloudWatch alarms should have an action configured CloudWatch alarms should have action enabled
PR.DS-1	Log groups should have encryption at rest enabled
PR.DS-5	Log groups should have encryption at rest enabled
PR.IP-7	CloudWatch alarms should have an action configured
PR.IP-8	CloudWatch alarms should have an action configured CloudWatch alarms should have action enabled
RC.RP-06	CloudWatch log groups should have retention period of at least 365 days

Clause	Controls from this module
C1.2 The entity disposes of confidential information to meet the entity's objectives related to confidentiality	CloudWatch log groups should have retention period of at least 365 days
CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate	CloudWatch alarms should have action enabled
CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.	CloudWatch log groups should have retention period of at least 365 days
CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures	CloudWatch log groups should have retention period of at least 365 days Log groups should have encryption at rest enabled
CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate	CloudWatch alarms should have an action configured
P4.2 The entity retains personal information consistent with the entity's objectives related to privacy	CloudWatch log groups should have retention period of at least 365 days
PI1.4 System outputs are complete, accurate, distributed only to intended parties, and retained to meet the entity's processing integrity commitments and system requirements	Log groups should have encryption at rest enabled

Clause	Controls from this module
Data protection	Log groups should have encryption at rest enabled
Identity and access management	CloudWatch log groups should have retention period of at least 365 days
REL11-BP06: Send notifications when events impact availability	CloudWatch alarms should have an action configured

Clause	Controls from this module
10: Change and Configuration Management	CloudWatch alarms should have an action configured
13 Incident Management	CloudWatch alarms should have an action configured
17 Archiving	CloudWatch log groups should have retention period of at least 365 days
7.1 Data Storage - Damage Protection	Log groups should have encryption at rest enabled

Clause	Controls from this module
Audit Record Retention (AU-11)	CloudWatch log groups should have retention period of at least 365 days
Incident Handling (IR-4)	CloudWatch alarms should have an action configured
Protection of Audit Information (AU-9)	Log groups should have encryption at rest enabled

Clause	Controls from this module
AU-6(1)(3)	CloudWatch log groups should have retention period of at least 365 days
AU-7 (1): Automatic Processing	CloudWatch alarms should have an action configured
Audit Record Retention (AU-11)	CloudWatch log groups should have retention period of at least 365 days
Information Handling and Retention (SI-12)	CloudWatch log groups should have retention period of at least 365 days
Protection of Audit Information (AU-9)	Log groups should have encryption at rest enabled
Protection of Information at Rest (SC-28)	Log groups should have encryption at rest enabled

Clause	Controls from this module
164.308(a)(1)(ii)(B) Risk Management	Log groups should have encryption at rest enabled
164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions	Log groups should have encryption at rest enabled
164.312(a)(2)(iv) Encryption and decryption	Log groups should have encryption at rest enabled
164.312(b) Audit controls	CloudWatch alarms should have an action configured CloudWatch log groups should have retention period of at least 365 days
164.312(e)(2)(ii) Encryption	Log groups should have encryption at rest enabled

Clause	Controls from this module
3.13.11 Employ FIPS-validated cryptography when used to protect the confidentiality of CUI	Log groups should have encryption at rest enabled
3.13.16: Protect the confidentiality of CUI at rest.	Log groups should have encryption at rest enabled
3.3.1: Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity	CloudWatch log groups should have retention period of at least 365 days
3.3.8: Protect audit information and audit logging tools from unauthorized access, modification, and deletion.	Log groups should have encryption at rest enabled
3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities	CloudWatch log groups should have retention period of at least 365 days
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization	CloudWatch log groups should have retention period of at least 365 days

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	SOC 2	HIPAA Omnibus Rule 2013
CloudWatch alarms should have an action configured	Enforced	Enforced
CloudWatch alarms should have action enabled	Enforced	Not active
CloudWatch log groups should have retention period of at least 365 days	Enforced	Enforced
Log groups should have encryption at rest enabled	Enforced	Enforced

4 controls enforced with a source URL change.

Start free trial Get started