Ensure a log metric filter and alarm exist for usage of root user

Property
Language
Severity
Service	cloudwatch
Provider	AWS

Description#

You can do real-time monitoring of API calls directing CloudTrail logs to CloudWatch Logs and establishing corresponding metric filters and alarms.

CIS recommends that you create a metric filter and alarm for root user login attempts. Monitoring for root user logins provides visibility into the use of a fully privileged account and an opportunity to reduce the use of it.

Resolution#

Create an alarm to alert on root user login