This source did not publish a separate summary. Review SKILL.md before using the skill.
SKILL.md
Implementing CloudTrail Log Analysis
When to Use
When building security monitoring pipelines for AWS API activity
When investigating security incidents to trace attacker actions across AWS services
When compliance requires audit logging of all administrative and data access operations
When creating detection rules for known attack patterns in AWS environments
When establishing baseline API behavior for anomaly detection
Do not use for real-time threat detection (use GuardDuty which already analyzes CloudTrail), for application-level logging (use CloudWatch Application Logs), or for network traffic analysis (use VPC Flow Logs).
Prerequisites
CloudTrail enabled with management events and optionally data events across all accounts
S3 bucket configured as CloudTrail delivery channel with appropriate retention policies
Amazon Athena configured with CloudTrail log table for ad-hoc queries
CloudWatch Logs subscription for real-time analysis with Logs Insights
SIEM integration (Splunk, Elastic, or Security Lake) for production monitoring
Workflow
Step 1: Configure CloudTrail for Comprehensive Logging
Ensure CloudTrail captures all relevant event types across the organization.
Execute queries to detect common attack patterns and suspicious activity.
-- Detect console logins without MFA
SELECT eventtime, useridentity.username, sourceipaddress, useridentity.arn
FROM cloudtrail_logs
WHERE eventname = 'ConsoleLogin'
AND additionalEventData LIKE '%"MFAUsed":"No"%'
AND errorcode IS NULL
ORDER BY eventtime DESC;
-- Find IAM privilege escalation attempts
SELECT eventtime, useridentity.arn, eventname, errorcode, sourceipaddress
FROM cloudtrail_logs
WHERE eventname IN (
'CreatePolicyVersion', 'SetDefaultPolicyVersion', 'AttachUserPolicy',
'AttachRolePolicy', 'PutUserPolicy', 'PutRolePolicy',
'CreateAccessKey', 'CreateLoginProfile', 'UpdateLoginProfile',
'PassRole', 'AssumeRole'
)
ORDER BY eventtime DESC
LIMIT 100;
-- Detect CloudTrail tampering
SELECT eventtime, useridentity.arn, eventname, requestparameters, sourceipaddress
FROM cloudtrail_logs
WHERE eventname IN ('StopLogging', 'DeleteTrail', 'UpdateTrail', 'PutEventSelectors')
ORDER BY eventtime DESC;
-- Find API calls from Tor exit nodes or unusual IPs
SELECT eventtime, useridentity.arn, eventname, sourceipaddress, awsregion
FROM cloudtrail_logs
WHERE sourceipaddress NOT LIKE '10.%'
AND sourceipaddress NOT LIKE '172.%'
AND sourceipaddress NOT LIKE '192.168.%'
AND useridentity.type = 'IAMUser'
AND errorcode IS NULL
GROUP BY eventtime, useridentity.arn, eventname, sourceipaddress, awsregion
ORDER BY eventtime DESC
LIMIT 200;
-- Detect unauthorized API calls (AccessDenied patterns)
SELECT useridentity.arn, eventname, COUNT(*) as denied_count
FROM cloudtrail_logs
WHERE errorcode IN ('AccessDenied', 'UnauthorizedAccess', 'Client.UnauthorizedAccess')
AND eventtime > date_format(date_add('day', -7, now()), '%Y-%m-%dT%H:%i:%sZ')
GROUP BY useridentity.arn, eventname
HAVING COUNT(*) > 10
ORDER BY denied_count DESC;
Step 4: Build Real-Time Detection with CloudWatch Logs Insights
Create real-time queries for active security monitoring.
AWS service that records API calls made to AWS services, providing an audit trail of actions taken by users, roles, and services
Management Events
CloudTrail events for control plane operations like creating resources, modifying IAM, and configuring services
Data Events
CloudTrail events for data plane operations like S3 object access and Lambda function invocations, providing granular activity logging
Log File Validation
CloudTrail feature that creates a digest file for verifying that log files have not been tampered with after delivery
CloudTrail Lake
Managed data lake for CloudTrail events enabling SQL-based queries without managing Athena tables or S3 data
Organization Trail
Single trail that captures API activity across all accounts in an AWS Organization to a central S3 bucket
Tools & Systems
Amazon Athena: Serverless SQL query engine for analyzing CloudTrail logs stored in S3 at scale
CloudWatch Logs Insights: Real-time log query service for interactive CloudTrail analysis within the last 30 days
CloudTrail Lake: Managed event data lake with built-in SQL query capabilities and 7-year retention
Amazon Security Lake: Centralized security data lake that normalizes CloudTrail data into OCSF format for SIEM consumption
AWS CloudTrail: Core audit logging service capturing all API activity across AWS accounts and services
Common Scenarios
Scenario: Investigating an IAM Credential Compromise Through CloudTrail
Context: GuardDuty alerts on UnauthorizedAccess:IAMUser/MaliciousIPCaller for a developer's access key. The security team needs to trace all actions taken by the compromised credential.
Approach:
Query CloudTrail for all events by the compromised AccessKeyId across all regions
Build a timeline of API calls to understand the attack sequence
Identify the initial access point (when did the key first appear from a malicious IP)
Map all resources created, modified, or accessed by the attacker
Check for persistence mechanisms (new users, access keys, Lambda functions, EC2 instances)
Verify CloudTrail was not tampered with (check for StopLogging or UpdateTrail events)
Document the full attack chain and scope of impact for the incident response report
Pitfalls: CloudTrail events can take up to 15 minutes to appear in S3 and CloudWatch Logs. For real-time visibility during active incidents, use CloudTrail Lake or CloudWatch Logs Insights rather than Athena queries against S3. Cross-region attacks require querying multiple region partitions in Athena.
