Module 15 · CloudTrail Forensics — Reading the Audit Log

Last updated: April 29, 2026

Why this module exists. If you can’t read CloudTrail, you can’t do cloud incident response. CloudTrail is to AWS what Windows Event Logs are to AD: every action by every principal is recorded. Most defenders skim the volume; experienced cloud-IR practitioners write surgical Athena queries that crack open incidents in 20 minutes.

What CloudTrail records

Every API call to AWS — console, CLI, SDK, automated. Three types of events:

• Management events — IAM changes, EC2 RunInstances, S3 bucket policy changes. Default: enabled, 90 days.
• Data events — S3 object reads/writes, Lambda invocations. Not enabled by default — you must opt in. Charged per million events.
• Insights events — anomaly detection on management events. Useful but not exhaustive.

For incident response, you need both management and data events. The “we forgot to enable data events” finding is in nearly every cloud-IR retrospective.

Storage architecture for the SOC

Default trails write to S3 with 90-day retention. For real IR:

• Multi-region trail — captures events from every region (attackers love unused regions).
• Organization trail — captures events from every account in the AWS Org. Single pane of glass.
• S3 retention 1+ year — DPDP “as long as necessary”; PCI 12 months; many breaches discovered >90 days post-event.
• Athena over the S3 bucket — SQL queries against billions of events. Pay per query, fast enough.
• Cross-account log archive — write logs to a different AWS account where the production workload’s IAM can’t delete them.

Five Athena queries every cloud SOC needs

1. Find IAM credential creation events. Persistence is most often new IAM users / access keys.

SELECT eventTime, userIdentity.arn, eventName, requestParameters
FROM cloudtrail
WHERE eventName IN ('CreateUser','CreateAccessKey','CreateLoginProfile','UpdateLoginProfile','AttachUserPolicy','PutUserPolicy')
  AND eventTime > date_add('day', -7, now())
ORDER BY eventTime DESC;

2. Find IAM-policy-changes that create privilege escalation paths.

SELECT eventTime, userIdentity.arn, eventName,
       requestParameters
FROM cloudtrail
WHERE eventName IN ('PutUserPolicy','AttachUserPolicy','PutRolePolicy','AttachRolePolicy','PutGroupPolicy','AttachGroupPolicy')
  AND CAST(json_extract(requestParameters,'$.policyDocument') AS VARCHAR) LIKE '%"Action": "*"%'
ORDER BY eventTime DESC;

3. Find ConsoleLogin events from unexpected locations.

SELECT eventTime, userIdentity.userName,
       sourceIPAddress,
       responseElements.ConsoleLogin
FROM cloudtrail
WHERE eventName = 'ConsoleLogin'
  AND eventTime > date_add('day', -7, now())
ORDER BY userName, eventTime;

Pivot: any user logging in from multiple countries within 24 hours = investigate.

4. Find AssumeRole calls outside expected paths.

SELECT eventTime, userIdentity.arn AS who,
       requestParameters.roleArn AS assumed,
       sourceIPAddress
FROM cloudtrail
WHERE eventName = 'AssumeRole'
  AND eventTime > date_add('hour', -24, now())
GROUP BY eventTime, userIdentity.arn, requestParameters.roleArn, sourceIPAddress
ORDER BY eventTime DESC;

5. Find S3 object operations against sensitive buckets (data-events trail required).

SELECT eventTime, userIdentity.arn,
       requestParameters.bucketName,
       requestParameters.key,
       eventName
FROM cloudtrail_data_events
WHERE requestParameters.bucketName IN ('prod-customer-data','backups')
  AND eventName IN ('GetObject','DeleteObject')
  AND eventTime > date_add('day', -1, now())
ORDER BY eventTime DESC;

The 12 most-abused API calls (your watchlist)

1. CreateUser — new IAM user; persistence
2. CreateAccessKey — new credentials; persistence
3. UpdateLoginProfile — set/reset console password
4. AttachUserPolicy with broad policy — privilege escalation
5. PutBucketPolicy with public principal — data exposure
6. PutBucketAcl public-read — data exposure
7. RunInstances with non-standard AMI — possible cryptomining
8. StopLogging on a CloudTrail trail — defender evasion
9. DeleteTrail — defender evasion
10. PutEventSelectors on a trail — possible scope reduction
11. ConsoleLogin with MFA = false on root — high alarm
12. GetSecretValue bursts — credential harvesting

SIEM rules for each, time-correlated, with deduplication.

Real-world cases

• Capital One 2019 — CloudTrail recorded every step. The forensic timeline was the report. The bug was “the alerts weren’t tuned” not “the data wasn’t there.”
• Many ransomware operations in 2024-25 attempt StopLogging early in their kill chain. SIEM alerting on this single API call has caught operations mid-flight.

Try this yourself

# Set up CloudTrail to log to your account
aws cloudtrail create-trail --name org-trail 
  --s3-bucket-name org-cloudtrail-logs 
  --is-multi-region-trail

aws cloudtrail start-logging --name org-trail

# Enable data events for sensitive S3 buckets
aws cloudtrail put-event-selectors --trail-name org-trail 
  --event-selectors '[{"ReadWriteType":"All","IncludeManagementEvents":true,"DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3:::sensitive-bucket/"]}]}]'

# Set up Athena over the trail
# Run the queries above

Defender’s checklist

• Org-wide multi-region trail, written to a logging account that production roles can’t access.
• Data events on sensitive S3 buckets, Lambda functions handling PII, KMS keys.
• 1+ year retention, longer for regulated workloads.
• Athena set up before the breach. Build the queries during peace time. Save them. Test them quarterly.
• SIEM rules for the 12 API calls above. Alert with high signal-to-noise tuning.
• S3 Object Lock on the CloudTrail logging bucket — even root can’t delete logs in compliance mode.