AWS security group change auditing

An AWS security group functions like a firewall, providing security at the protocol and port access levels. Rules added to a security group allow traffic to or from the security group's associated instances. These rules can be modified at any time and are automatically applied to all instances that are associated with the security group.

Accidentally adding a malicious IP address to a security group can result in a security fiasco. With so much at stake, keeping track of every security group change is of utmost importance. Cloud Security Plus offers reports on security group changes, enabling security administrators to quickly detect anomalies and mitigate threats.

Reports on security group changes

These reports provide information on security group changes, including details about the event, the user who made the change, and the source IP from which the change was made. These reports track a number of security group changes, including:

• Created security groups.
• Deleted security groups.
• Security group configuration changes.
• Authorized security group ingress and egress.
• Revoked security group ingress and egress.
• Network gateway changes.
• Network Access Control List (ACL) changes.