Skip to content

Terraform AWS CloudWatch

Log groups, metric alarms, dashboards, retention settings, subscription filters, and event rules used for monitoring, alerting, forensic visibility, and audit support.

2 controls enforced14 frameworks

Controls Enforced

The following compliance controls are enforced by this module at terraform plan time.

Quick Start

module "cloudwatch" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "acscism2023.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "awscontroltower.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "awsgenai.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cis.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cisv500.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cisv600.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "cisacyberessentials.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "eugmpannex11.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "fedramplow.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "ffiec.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "gdpr.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nis2.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "rbicybersecurity.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "rbiitfnbfc.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

module "cloudwatch" {
  source  = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "<version>"

  # ... your arguments here
}

See the Get Started guide to get started and read the Features section for more details on how to customize the module for your requirements.

Migration from Upstream

Already using terraform-aws-modules? Change only the source URL:

module "cloudwatch" {
  source  = "terraform-aws-modules/cloudwatch/aws"
  version = "1.0"
}

module "cloudwatch" {
  source  = "soc2.compliance.tf/terraform-aws-modules/cloudwatch/aws"
  version = "1.0"
}

Same arguments. Same outputs. Compliance controls are enforced automatically at terraform plan. If a required value is missing, you get a clear validation error telling you what to set.

See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL to the upstream path:

module "cloudwatch" {
  source  = "terraform-aws-modules/cloudwatch/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ACSC-EE-ML3-7.10: Multi-factor authentication ML3

REL11-BP06: Send notifications when events impact availability

AC-2(4): Automated Audit Actions

13 Incident Management

Incident Handling (IR-4)

AU-7 (1): Automatic Processing

D5.DR.De.B.3

164.312(b) Audit controls

IA-10: Adaptive Authentication

DE.DP-4

PR.IP-7

PR.IP-8

PR.IR-04

RC.CO-03

500.14(a)

10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.

10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.

10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.

10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.

10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.

10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.

10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.

11.5.2: A change-detection mechanism (for example, file integrity monitoring tools) is deployed

11.5.2: Network intrusions and unexpected file changes are detected and responded to.

11.6.1: Unauthorized changes on payment pages are detected and responded to.

12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.

12.10.5: The security incident response plan includes monitoring and responding to alerts from security monitoring systems

A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.

A3.5.1: Suspicious events are identified and responded to.

CC4.2 COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate

CC7.4 The entity responds to identified security incidents by executing a defined incident response program to understand, contain, remediate, and communicate security incidents, as appropriate

Framework Coverage

Which controls from this module are active under each framework endpoint. ● enforced by default · ○ not activated by this endpoint

ControlNIST Cybersecurity Framework v2.0SOC 2ACSC Essential EightAWS Well-Architected Framework v10CCCS Medium Cloud Control ProfileEU GMP Annex 11FedRAMP Low Baseline Rev 4FedRAMP Moderate Baseline Rev 4
CloudWatch alarm should have an action configured●●●●●●●●
CloudWatch alarm action should be enabled●●○○○○○○

Showing top 8 frameworks by coverage. All framework endpoints →