As cloud infrastructure becomes the backbone of modern enterprises, securing these environments is crucial. With Amazon Web Services (AWS) remaining the leading cloud provider, it’s essential for security professionals to know where to look for signs of compromise. AWS CloudTrail is a vital tool for tracking and logging API activity, offering a comprehensive record of actions within an AWS account. Think of CloudTrail as an audit log for all API calls in your AWS account. For security professionals, monitoring these logs is critical, especially for detecting unauthorized access, such as through stolen API keys. The techniques I’ve learned from handling AWS incidents are built into the SANS FOR509, Enterprise Cloud Forensics course.
1. Unusual API Calls and Access Patterns
Sudden Spike in API Requests
One of the first indicators of a potential security breach is an unexpected surge in API requests. CloudTrail logs every API call within your AWS account, including details like who made the call, when, and from where. An attacker with stolen API keys might generate numerous requests in a short period, probing the account or attempting to exploit services.
What to Look For:
– A sudden and unusual increase in API activity.
– API calls from unfamiliar IP addresses, particularly from regions where your legitimate users don’t operate.
– Access attempts to a variety of services not typically used by your organization.
Note: If enabled, GuardDuty will automatically flag these events, but you need to actively monitor them.
B. Unauthorized Use of Root Account
AWS advises against using the root account for day-to-day operations due to its high privileges. Any root account access, especially if API keys are involved, is a significant red flag.
What to Look For:
– API calls made with root account credentials, especially if the root account is rarely used.
– Changes to account-level settings, such as billing information or account configurations.
2. Anomalous IAM Activity
Suspicious Creation of Access Keys
Attackers may create new access keys to maintain persistent access to a compromised account. Monitoring CloudTrail logs for the creation of new access keys is essential, especially if these keys are created for accounts that typically don’t need them.
What to Look For:
– Creation of new access keys for IAM users who haven’t needed them before.
– Immediate use of newly created keys, indicating possible attacker activity.
– API calls like `CreateAccessKey`, `ListAccessKeys`, and `UpdateAccessKey`.
C. Role Assumption Patterns
AWS allows users to assume roles, granting temporary credentials for specific tasks. Monitoring for unusual role assumptions is crucial, as an attacker might assume roles to move laterally within your environment.
What to Look For:
– Unusual or frequent `AssumeRole` API calls, particularly to roles with elevated privileges.
– Role assumptions from unfamiliar IP addresses or regions.
– Role assumptions followed by actions inconsistent with regular business operations.
3. Anomalous Data Access and Movement
A. Unusual S3 Bucket Access
Amazon S3 is often a target for attackers because it can store large amounts of sensitive data. Monitoring CloudTrail for unusual S3 bucket access is critical for detecting compromised API keys.
What to Look For:
– API calls like `ListBuckets`, `GetObject`, or `PutObject` for buckets that typically don’t see such activity.
– Large-scale data downloads or uploads to/from S3, especially outside of business hours.
– Access attempts to buckets containing sensitive data, such as backups or confidential files.
B. Data Exfiltration Attempts
Attackers may try to move data out of your AWS environment. CloudTrail logs can help detect these attempts, especially if data transfer patterns are unusual.
What to Look For:
– Large data transfers from services like S3, RDS, or DynamoDB to external or unknown IP addresses.
– API calls related to services like AWS DataSync or S3 Transfer Acceleration that aren’t commonly used in your environment.
– Attempts to create or modify data replication configurations, such as S3 cross-region replication.
4. Unexpected Security Group Modifications
Security groups control inbound and outbound traffic to AWS resources. Attackers might modify these settings to open additional attack vectors, like enabling SSH access from external IP addresses.
What to Look For:
– Changes to security group rules that allow traffic from untrusted IP addresses.
– API calls related to `AuthorizeSecurityGroupIngress` or `RevokeSecurityGroupEgress` that don’t match normal operations.
– Creation of new security groups with overly permissive rules, such as allowing all inbound traffic on common ports.
5. Mitigating the Risk of Stolen API Keys
Enforce the Principle of Least Privilege
Minimize the damage attackers can do with stolen API keys by enforcing least privilege across your AWS account. Ensure IAM users and roles only have the permissions they need.
Implement Multi-Factor Authentication (MFA)
Require MFA for all IAM users, especially those with administrative privileges. This adds an extra layer of security, making it harder for attackers to gain access even with stolen API keys.
Regularly Rotate and Audit Access Keys
Rotate access keys regularly and ensure they’re only used by IAM users who need them. Audit the use of access keys to ensure they aren’t being abused or used from unexpected locations.
Enable and Monitor CloudTrail and GuardDuty
Make sure CloudTrail is enabled in all regions and that logs are centralized for analysis. AWS GuardDuty provides real-time monitoring for malicious activity, offering additional protection against compromised credentials. Consider AWS Detective for enhanced analysis of findings.
Use AWS Config for Compliance Monitoring
AWS Config can help monitor compliance with security best practices, such as proper use of IAM policies and security groups. This tool can identify misconfigurations that might leave your account vulnerable.
Conclusion
Securing your AWS environment requires vigilant monitoring and rapid detection of anomalies in CloudTrail logs. By understanding normal usage patterns and staying alert to deviations, security professionals can detect and respond to potential compromises, like stolen API keys, before significant damage occurs. As cloud environments evolve, staying proactive about security is essential to protecting sensitive data and maintaining the integrity of your AWS infrastructure. For more insights on detecting intrusions in AWS, Microsoft, and Google clouds, consider attending my class, FOR509, at SANS Cyber Defense Initiative 2024.
 remaining the leading cloud provider, it's essential for security professionals to know where to look for s){kind=link}