Lesson 2.13: Audit logging with CloudTrail
Every action in a cloud account is an API call, and the provider can record them all: who, what, when, from where, with which key, and whether it worked. In AWS this is CloudTrail; Azure has the Activity Log and Google Cloud has Cloud Audit Logs. Attackers know it too, and one of their first moves is to switch it off. In the lab you find Northwind's trail stopped, use CloudTrail's 90-day event history to see who stopped it and what else the same key did, start logging again, and set up what should have alerted on it.
17 min
You will learn to
- Explain what cloud audit logs record
- Check a trail's configuration and status
- Search events by name and access key
- Read a CloudTrail event record
- Restart logging and alert on tampering
Key terms
- CloudTrail
- AWS's record of API activity in an account: identity, action, time, source IP, user agent, parameters, result.
- Trail
- A configuration that delivers CloudTrail events to storage for long-term retention.
- Management vs data events
- Control-plane actions (create, delete, configure) vs data-plane actions (reading or writing objects).
- Log file validation
- Signed digest files that prove delivered log files weren't modified or deleted.
- Defense evasion (T1562.008)
- Disabling or modifying cloud logs to hide activity.
← Sysmon and process trees · All lessons · Verifying downloads →