How do I create an EventBridge rule for AWS account root user login alerts?

Resolution

To monitor account root user login activity, create an Amazon EventBridge rule that monitors the userIdentity element in AWS CloudTrail logs. The EventBridge rule uses Amazon Simple Notification Service (Amazon SNS) to send notifications when the root user signs in to the AWS Management Console.

For CloudTrail to send API calls to EventBridge, you must create a trail in the same AWS Region as the EventBridge rule. Configure the trail's management events as Read and Write or only Write.

To create the EventBridge rule and SNS topic, you can use Amazon SNS and EventBridge. Or, use AWS CloudFormation.

Use Amazon SNS and EventBridge

Create an Amazon SNS topic and subscription

Complete the following steps:

1. Create an Amazon SNS topic.
2. Subscribe an endpoint to the topic.
3. Check your email inbox for the AWS confirmation email.
4. In the email, choose Confirm subscription to confirm the SNS subscription request. You then receive a "Subscription confirmed!" message.

Create an EventBridge rule

Complete the following steps:

1. Open the EventBridge console in the US East (N. Virginia) Region.

2. In the navigation pane, choose Rules, and then choose Create rule.

3. For Name and Description, enter a name and description for the rule.

4. For Rule type, choose Rule with an event pattern, and then choose Next.

5. For Event source, choose AWS events or EventBridge partner events.

6. Under Event pattern, choose Custom pattern (JSON editor).

7. In the Event pattern JSON editor, enter the following root user login pattern:

   {
   
   "detail-type": ["AWS Console Sign In via CloudTrail"],
   
   "detail": {
   
   "userIdentity": {
   
   "type": ["Root"]
   
   }
   
   }
   
   }

8. Choose Next.

9. Configure the following settings for your target:
   For Target types, choose AWS service.
   For Select a target, choose SNS topic.
   For Topic, select the topic that you created.

10. Choose Next.

11. (Optional) Add tags to the rule.

12. Choose Next.

13. Review the rule's details, and then choose Create rule.

Use CloudFormation

Create the CloudFormation template

To create the EventBridge rule and SNS topic, enter the following YAML template into a text editor, and then save the file:

# Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
# software and associated documentation files (the "Software"), to deal in the Software
# without restriction, including without limitation the rights to use, copy, modify,
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
# permit persons to whom the Software is furnished to do so.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
# PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
# HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
# OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
# SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

AWSTemplateFormatVersion: '2010-09-09'
Description: ROOT-AWS-Console-Sign-In-via-CloudTrail
Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
    - Label:
        default: Amazon SNS parameters
      Parameters:
      - Email Address
Parameters:
  EmailAddress:
    Type: String
    ConstraintDescription: Email address required.
    Description: Enter an email address you want to subscribe to the Amazon SNS topic
      that will send notifications if your account's AWS root user logs in.
Resources:
  RootActivitySNSTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: ROOT-AWS-Console-Sign-In-via-CloudTrail
      Subscription:
      - Endpoint:
          Ref: EmailAddress
        Protocol: email
      TopicName: ROOT-AWS-Console-Sign-In-via-CloudTrail
  EventsRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Events rule for monitoring root AWS Console Sign In activity
      EventPattern:
        detail-type:
        - AWS Console Sign In via CloudTrail
        detail:
          userIdentity:
            type:
            - Root
      Name:
        Fn::Sub: "${AWS::StackName}-RootActivityRule"
      State: ENABLED
      Targets:
      - Arn:
          Ref: RootActivitySNSTopic
        Id: RootActivitySNSTopic
    DependsOn:
    - RootActivitySNSTopic
  RootPolicyDocument:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: RootPolicyDocument
        Version: '2012-10-17'
        Statement:
        - Sid: RootPolicyDocument
          Effect: Allow
          Principal:
            Service: events.amazonaws.com
          Action: sns:Publish
          Resource:
          - Ref: RootActivitySNSTopic
      Topics:
      - Ref: RootActivitySNSTopic
Outputs:
  EventsRule:
    Value:
      Ref: EventsRule
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-RootAPIMonitorEventsRule"
    Description: Event Rule ID.

Create the CloudFormation stack

Use the CloudFormation console to create the CloudFormation stack. On the Create stack page, choose Upload a template file to upload the template that you created. On the Configure stack options page, under Notifications options, enter the email address that you want AWS to send notifications to.

Test your SNS setup

Complete the following steps:

1. Sign out of the AWS Management Console, and then sign in to the AWS Management Console as the account root user.
2. Check your email inbox for an AWS notification.
3. Note the userIdentity, sourceIPAddress, and MFAUsed CloudTrail records that contain details about the login event.

Note: To no longer receive notifications, delete the CloudFormation stack that you created.

Related information

How to receive notifications when your AWS account's root access keys are used

Monitor and notify on AWS account root user activity

AWS::CloudWatch::Alarm