AWS¶
CloudTrail¶
Primary AWS API/audit trail: who called what API against which resource, from where?
| High-value field | Use |
|---|---|
eventTime |
Timeline |
eventSource / eventName |
Service and action |
awsRegion |
Region scope |
sourceIPAddress / userAgent |
Origin and client/tool |
userIdentity |
Principal, ARN, account, key, session |
requestParameters / responseElements |
Target and result details |
errorCode / errorMessage |
Failure context |
Inspect userIdentity.type, principalId, arn, accountId, accessKeyId, and sessionContext.
High-value events¶
| Category | Events |
|---|---|
| Authentication | ConsoleLogin |
| IAM users/roles | CreateUser, DeleteUser, CreateRole, DeleteRole |
| Policies/groups | AttachUserPolicy, AttachRolePolicy, PutUserPolicy, PutRolePolicy, AddUserToGroup |
| Credentials | CreateAccessKey, UpdateAccessKey, CreateLoginProfile, UpdateLoginProfile |
| Role use | AssumeRole |
| Logging changes | StopLogging, DeleteTrail, UpdateTrail |
| EC2/network | RunInstances, TerminateInstances, AuthorizeSecurityGroupIngress, ModifyInstanceAttribute |
| S3 | CreateBucket, DeleteBucket, PutBucketPolicy, PutBucketAcl, GetObject, PutObject, DeleteObject |
| Secrets/KMS | GetSecretValue, Decrypt, CreateKey, DisableKey, ScheduleKeyDeletion |
Recent console logons
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 20
Recent access-key creation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateAccessKey --max-results 20
GuardDuty¶
CloudTrail provides raw/audit activity; GuardDuty provides managed findings derived from supported AWS telemetry such as CloudTrail events, VPC Flow Logs, DNS logs, and enabled feature-specific sources.
VPC Flow Logs¶
Use source, destination, ports, protocol, accept/reject, bytes, and packets. Pivot to ENI/resource identity and CloudTrail changes.
S3 data access¶
CloudTrail data events or appropriate access logging help establish who accessed which object, when, and from where. Confirm that required data-event coverage was enabled during the period.