Summary

To summarize, AWS offers integration of API logs and generic event logs and provides a SPOG to determine threat actor activity or an insider threat within an AWS account. With CloudWatch and CloudTrail, DFIR teams can natively investigate AWS using AWS’s tools and identify activities an unauthorized user performs at a granular level. Furthermore, resources such as EC2 and S3 offer additional information concerning the configuration that allows DFIR teams to deduce and obtain further information for investigations. Remember that some security solutions, such as VPC flow logs, are not enabled by default and require the account owner or administrator to allow them explicitly. Integrating CloudTrail logs with CloudWatch and enabling Amazon GuardDuty offers DFIR teams a deep insight into threats within an AWS account and resources without explicitly going through deployments of security tools. Enabling GuardDuty and, subsequently, Amazon Detective allows telemetric information...