cis-aws-euc-2-9

name	cis-aws-euc-2.9
description	Ensure CloudWatch is set up for WorkSpaces
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","cloudwatch","monitoring","logging"]
cis_id	2.9
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.8","cis-aws-euc-2.10"]
prerequisites	[]
severity_boost	{}

Ensure CloudWatch is set up for WorkSpaces (Manual)

Profile Applicability

• Level 1

Description

Set up and utilize Amazon CloudWatch Events for successful logins to WorkSpaces.

Rationale

Use Cloudwatch to store/archive WorkSpaces login events for future reference, analysis, and action based on the patterns. Utilize the IP address collected to figure out where users are logged in from, and then build policies to allow access only to files or data from those WorkSpaces that meet company access criteria. With this information you can also use policy controls to block access from unauthorized IP addresses.

Impact

None specified in the benchmark.

Audit Procedure

Using AWS Console

Perform the following steps to review the rules for CloudWatch and WorkSpaces Events:

1. Login to the CloudWatch console at https://console.aws.amazon.com/cloudwatch/
2. In the left pane click Rules
3. Click Rules
4. Click on the Rule Name for your WorkSpaces Access Events
5. Confirm the Event Pattern:

{
  "source": ["aws.workspaces"],
  "detail-type": ["WorkSpaces Access"]
}

6. Confirm Status is Enabled
7. Confirm at least one Target is created for CloudWatch Log Group

If there is no CloudWatch Event created with the rule as outlined above refer to the remediation below.

Remediation

Using AWS Console

Perform the following steps to create a Rule for CloudWatch WorkSpaces Events:

1. Login to the CloudWatch console at https://console.aws.amazon.com/cloudwatch/
2. In the left pane click Rules
3. Click Create rule
4. For Event Source, do the following: