Currently in order to setup auto-remediation for the Cloudwatch controls 1-14 you need to perform some initial configuration.
...
The following information takes you through what needs to be checked in order to perform auto-remediation on Cloudwatch controls 1-14 in AUTOMATE+.
Goal - ability to use Auto-remediation for controls Cloudwatch.1 → Cloudwatch.14
A select number of controls, namely Cloudwatch.1 → Cloudwatch.14 require additional manual effort in order for a customer to leverage the auto-remediation toggle.
IMPORTANT NOTE: Skip the below steps if the controls are already showing as PASSED except for CloudTrail.1
Once the following steps have been completed you may then use “Auto-remediation” with AUTOMATE+ for Cloudwatch.1 → Cloudwatch.14:
...
After AUTOMATE+ deployment, or if you have already deployed AUTOMATE+
a) check . Check the CloudTrail.1 control:
i. If the control is failed in AUTOMATE+, expand the control on the Automation page and click Remediate in the dropdown. This will create a Multi-region CloudTrail for you.
...
1. Navigate to AWS CloudTrail
2. Click on Dashboard (from the left-hand menu)
3. Click on Create Trail
4. Use CloudTrail name: multi-region-cloud-trail
5. Create new S3 bucket (use automatic name prefilled)
6. SSE-KMS encryption: leave checked
7. KMS Alias: select Existing
8. Select Existing KMS alias: SO0111-SHARR-Remediation-Key
9. Log File Validation: Leave Checked
10. SNS Notification Delivery: Leave unchecked
11. CloudWatch Logs: select Enable
12. Paste in the following CloudWatch log group name: six-pillars-aws-cloudwatch-cloudtrail
13. For Assumed Role, select Existing and choose: SO0111-CloudTrailToCloudWatchLogs
14. Click Next
15. Click Next again
16. Click Create Trail
b. Check CloudTrail.4
i. If the control is FAILED, trigger instance remediation via the Automation page.
c. Check CloudTrail.5
i. if the control is FAILED, trigger instance remediation via the Automation page.
ii. if you created a new trail following step 1.a.ii. Please follow below steps or wait for that resource show up in Cloudtrail.5 as a resource and trigger instance remediation to correct this.
...