Investigating AWS Incidents

In AWS an incident is reconstructed from logs the attacker usually could not delete -- CloudTrail, VPC Flow Logs, and the control plane's own record of every API call. The investigation is therefore a log-correlation exercise anchored on the compromised principal: the access key or assumed role, and the sequence of API calls it made. Find the principal, pull every event it generated, and the rest of the intrusion falls out of the timeline.

When to Use

• Exposed or leaked AWS access keys -- committed to a repo, in a pastebin, or flagged by AWS abuse
• Anomalous CloudTrail activity -- API calls from unfamiliar regions, IPs, or user agents
• A GuardDuty finding -- credential exfiltration, tor traffic, crypto-mining, or anomalous IAM behavior
• Unexpected IAM changes -- new users, keys, roles, login profiles, or policy attachments nobody authorized
• Crypto-mining EC2 -- a spike in on-demand instances, GPU families, or an unexpected billing alert
• S3 data exfiltration -- GetObject spikes, buckets made public, or shared snapshots

When NOT to Use