Amazon Web Services — detection-relevant internals

This skill encodes how AWS security-relevant services work at the level needed to detect cloud infrastructure abuse.

1. CloudTrail event structure

Every AWS API call generates a CloudTrail event. Key fields: