Published on: 12/1/2025
4 minute read
Introduction
As we work to increase Zero Trust (ZT) maturity at the Centers for Medicare & Medicaid Services (CMS), the ZT Working Group shares tools, knowledge, and best practices with the cybersecurity community.
This post provides a quick, practical guide for application teams at CMS to help them strengthen their cloud security strategy using Terraform CloudWatch alarms for their infrastructure environments.
What are Terraform CloudWatch alarms?
Terraform CloudWatch alarms are Infrastructure as Code (IaC) configurations that automatically create and manage Amazon CloudWatch alarms in your AWS environment. CloudWatch alarms are monitoring tools that watch specific metrics and trigger notifications when predefined thresholds are breached, or specific conditions are met. By using Terraform to manage these alerts, you can:
- Automate alerts
- Create consistent deployments
- Maintain version control
- Integrate with CI/CD pipelines
See the Zero Trust CloudWatch alarms in CMS GitHub (CMS login required to access).
Zero Trust alignment through Pillar-Function mapping
What makes this Terraform module particularly important is its alignment with the CISA Zero Trust Maturity Model v2 and its ability to support Pillar-Function mapping. A Pillar-Function pair is a coupling of a foundational security Pillar (a domain of trust) with the necessary security Functions (the specific actions or capabilities) required to enforce Zero Trust principles within that domain.
Pillar-Function mapping is the process of aligning an organization's existing security tools, policies, and roadmap to these specific ZT pillars and functions. Each of the eleven CloudWatch alerts are mapped to Zero Trust Pillar-Function pairs, ensuring comprehensive coverage across all critical security domains:
| Zero Trust Pillar | How CloudWatch supports it (Functions) |
|---|---|
| Identity Pillar | Monitors authentication and access management through IAM-related alerts |
| Devices Pillar | Tracks device compliance and health via EC2 status monitoring |
| Networks Pillar | Oversees network segmentation and traffic management through VPC and security group alerts |
| Applications and Workloads Pillar | Protects application access and workload security via container and Kubernetes monitoring |
| Data Pillar | Ensure data access controls and encryption compliance through S3-focused alerts |
The power of Terraform for alert management
Traditional CloudWatch alarm setup requires manual configuration through the AWS console or complex CLI commands. Terraform transforms this process by allowing you to define your entire monitoring strategy in code. This means your security monitoring becomes:
Repeatable - Deploy the same monitoring setup across multiple AWS accounts
Maintainable - Update monitoring rules by modifying code rather than clicking through consoles
Auditable - Track who changed what monitoring rules and when
Scalable - Easily add new alarms or modify existing ones as your infrastructure grows
Cyber threats are constantly evolving, making proactive monitoring and alerting crucial for any team’s cloud security strategy. This comprehensive Terraform module provides eleven critical CloudWatch alarms that align with the CISA Zero Trust Maturity Model v2, giving your team the visibility and alerting capability needed to detect security anomalies across your AWS environment.
Why this matters for your team
Adding this capability to your team’s repertoire provides both immediate security improvements and long-term operational benefits, such as:
- Real-time threat detection - Get instant alerts when security events occur
- Compliance automation - Automatically monitor adherence to security best practices
- Zero Trust alignment - Implement monitoring that supports modern security frameworks
- Reduced manual overhead - Automate security monitoring tasks your team currently does manually
- Faster incident response - Detect issues before they become major security incidents
Getting started
To start using the Terraform module, CMS teams can deploy this basic configuration to establish Zero Trust monitoring across their AWS environments. The module enables teams to quickly implement automated security alerting. Teams can customize the organization name, specify their existing CloudTrail log group, and configure alert emails to receive immediate notifications when security events occur.
- Configure your values: Update the module with your specific details
module "cloudwatch_compliance_alarms" { source = "./CMS-ZT-CloudWatch-Alarms” # Only required variables org_name = "MyOrg" cloudtrail_log_group_name = "my-cloudtrail-logs" alert_emails = ["security@example.com"] } |
- Deploy the module:
terraform init terraform plan terraform apply |
- Confirm email subscriptions: Check your email and click the SNS confirmation links
- Validate deployment: Verify alarms are created in AWS CloudWatch console
Deeper dive
This basic example gets you started, but for comprehensive guidance on deploying and customizing the Terraform module, visit the project repository and README documentation (CMS login required to access). There you will find:
Detailed documentation:
- Complete variable reference and configuration options
- Prerequisites and setup requirements
- Troubleshooting guides and common issues
Three complete examples:
- Minimal Example - Perfect for testing and getting started
- Complete Example - Full-featured implementation with all customization options
- Existing SNS Example - Integration with your current notification systems
Advanced configuration:
- Selective alarm enablement/disablement
- Custom environment and region settings
- Integration patterns with existing infrastructure
- Output values for connecting with other Terraform modules
Deployment guides:
- Step-by-step deployment instructions
- Environment-specific configuration examples
- Best practices for production deployments
Implementation options:
- Start Small - Deploy the minimal example to test in your dev environment
- Full Featured - Use the complete example with all customization options
- Integrate Existing - Connect to your current SNS topics and notification systems
Conclusion
Ready to enhance your security protection? Deploy the Terraform CloudWatch alarm modules (CMS login required).
They will provide your team with security monitoring that aligns with Zero Trust principles and keeps your AWS environment secure, compliant, and resilient against evolving threats.
About the author
Brey Warren is a U.S. Digital Corps Cybersecurity Fellow supporting the Zero Trust team within the Centers for Medicare & Medicaid Services (CMS).
