☁️ Cloud Artefacts

Cloud Logs

Audit

Login activity

For admin account go to IAM -> Credential report to see all the users and the following information:

1. user name
2. arn (acc N + username)
3. user_creation_time
4. password_enabled
5. password_last_used
6. password_last_changed
7. password_next_rotation
8. mfa_active
9. access_key_1_active
10. access_key_1_last_rotated
11. access_key_1_last_used_date
12. access_key_1_last_used_region
13. access_key_1_last_used_service
14. access_key_2_active
15. access_key_2_last_rotated
16. access_key_2_last_used_date
17. access_key_2_last_used_region
18. access_key_2_last_used_service
19. cert_1_active
20. cert_1_last_rotated
21. cert_2_active
22. cert_2_last_rotated

Service usage activity

Also, you can go to IAM -> username -> Access Advisor tab to see the services that this user has access to and when these were last used.

Cloud Users And Policies

IAM

Stands for Identity Access Management. There are several types of IAM identities. They are usually called “Principal”. This can be either a User or a Role. It can even be a service or an account. Users can assume Roles. Instance Profile is basically a separate IAM Role assumed by this particular instance.

IAM role. Some entity (principal in AWS language) that can be assumed by others (users, services, instances, accounts). However assumes the role, is provided with temporary credentials.

AWS Configuration

Default Configurations

By default, SSH 22 and RDP 3389 are closed, but these are suggested to be opened when creaing them, warning how dangeroud this is. What’s traffic mirroring? Using this functionality with open-source tools.

Custom Config

If SSM is enabled (System Manager Service), then activity is logged in CloudTrail. At least, AmazonSSMManagedInstanceCore needs to be attached to the instance profile role. Look at the policies and which users are granted the access. Also, commands run can be also restricted.