Which compliance frameworks require ensure metric filters exist for root account usage?

This security check is required by the following compliance frameworks: CIS AWS v1.5.0, CIS AWS v2.0, SOC 2, PCI-DSS, HIPAA.

HIGHCIS 4.3

Ensure metric filters exist for root account usage

CloudWatch metric filters should alert on any root account usage as root should rarely be used for normal operations.

Security Impact

Root account usage should trigger immediate investigation as it indicates either legitimate emergency or compromise.

How to Remediate

Create metric filter: '{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }'

Affected Resources

AWS::Logs::MetricFilterAWS::CloudWatch::Alarm

Compliance Frameworks

CIS AWS v1.5.0CIS AWS v2.0SOC 2PCI-DSSHIPAA

How TigerGate Helps

TigerGate continuously monitors your AWS environment to detect and alert on this misconfiguration. Here's what our platform does for this specific check:

Continuous Scanning
Automatically scans all AWS CloudTrail resources across your AWS accounts every hour
Instant Alerts
Get notified via Slack, email, or webhooks when this misconfiguration is detected
One-Click Remediation
Fix this issue directly from the TigerGate dashboard with our guided remediation
Compliance Evidence
Automatically collect audit evidence for CIS AWS v1.5.0, CIS AWS v2.0, SOC 2 compliance
Drift Detection
Get alerted if this configuration drifts back to an insecure state after remediation