CloudTrail Root Account Monitor — Alert on Root API Usage via Lambda
Lambda function triggered by EventBridge to detect any AWS root account API activity in CloudTrail and immediately send a critical security …
Jan 20, 2025
Read more
Cloudtrail
4 articles
EC2 Instance Communicating with Malicious IP — Incident Response
Your VPC flow logs show an EC2 instance sending traffic to a known malicious IP address. Walk through containment, forensic investigation, …
Jan 20, 2025
Read more
Generate Least-Privilege IAM Policy from CloudTrail Logs
Python script that analyses CloudTrail logs for a given IAM role and generates a minimal IAM policy containing only the actions the role …
Jan 20, 2025
Read more
Developer Pushed AWS Credentials to Public GitHub — Incident Response
A developer accidentally committed live AWS access keys to a public GitHub repository. Walk through the immediate containment, …
Jan 20, 2025
Read more