Reading AWS receipts
1. Reading AWS receipts
You know the modes now, and which gate decides who can decrypt. So assume the worst has already happened. A customer file was downloaded, nobody knows who took it, and the only thing that can answer is the record AWS kept. This video is about that record, and about when it holds nothing at all.2. What one record holds
CloudTrail records API calls in your account, and one event is the receipt for one call. Four fields carry most of it: what was called, when, who called it, and which resource they named.3. What one record holds
A fifth field decides more investigations than the other four. errorCode appears when the call was refused, so the log holds attempts, not only successes. A denied request is evidence too.4. The log names the principal
Of those four fields, who has two answers. The arn field names the session that made the call; inside sessionContext, sessionIssuer names the role it came from. That pair is the principal AWS evaluated, and one ARN says sts while the other says iam.5. The log names the principal
The actor is never a field. Early in this course we used a courier: the desk checks the courier's badge, not yours. The log records the badge exactly, and leaves you to infer the sender.6. Keep four fields, not forty
A real event carries forty fields or more. Almost none of them matter. Pull out four and you have a receipt: actor, principal, action, and resource.7. Keep four fields, not forty
Action comes straight from eventName. Resource comes from requestParameters, where the bucket and the object key sit. Four fields, not forty, and the same four work on every event. If there is an event.8. On by default, or off by default
CloudTrail splits activity in two. Management events are control plane calls: creating a bucket, attaching a policy, signing in, and every cryptographic call to a KMS key, so a Decrypt lands here rather than with the object read it served. Every account records those by default, and keeps ninety days of them for free.9. On by default, or off by default
Data events are what happens inside a resource: reading an object, invoking a function, writing an item. No trail records those until you add a data event selector for that resource type, and they are billed separately.10. Nobody was recording that
So the honest first answer to who took that file is often that nobody was recording it. A library catalog shows when a book joined the collection, not who opened it at a table.11. Nobody was recording that
Where the camera points is decided before the theft, not after. So decide in advance: turn data events on for the buckets and functions that hold customer data, and leave the rest off.12. Evidence, pointed forwards
Evidence is not only for post mortems, the write-up after something goes wrong. IAM Access Analyzer checks and writes IAM policies for you. Policy validation reads a policy you already wrote and flags a statement broader than you meant, or a resource an action cannot act on.13. Evidence, pointed forwards
Policy generation runs the other way. It reads up to ninety days of your trail and writes a policy holding only what that role used. Generation writes the draft; validation is what stops you applying it unread. A worn path shows where people walk; pave that one.14. Granted, and never used
Unused access findings ask the opposite question. Which roles has nobody assumed, which keys has nobody used, and which actions were never called? One role here was granted forty two actions and used three. Granted is not the same as used.15. Granted, and never used
One limit, and it matters. Generation writes the draft from what the role actually used. What it cannot tell you is whether an action it never saw will be needed next quarter.16. Granted, and never used
That closes the loop this course opened. Least privilege started as a guess about what a role needs, and the log turns it into a measurement. Before your next incident, ask which of today's actions you could prove.17. Let's practice!
Time to practice reading AWS receipts with a few questions.Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.