10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer

10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests your ability to audit API activity and identity security, query audit telemetry across multi-account environments using CloudTrail Lake SQL queries, discover unintended public and cross-account resource exposure with IAM Access Analyzer, enforce least privilege with Unused Access Analyzer, and evaluate credential health using Credential Reports and Policy Simulator.

CloudTrail Multi-Region Trails, Encryption & Digest File Integrity

AWS CloudTrail records all AWS API invocations as structured JSON event logs, providing the foundation for security auditing and operational governance.

Multi-Region Trails & Centralized Aggregation

Enterprise standards mandate deploying an organization-wide multi-Region trail from the AWS Organizations management account:

• Comprehensive Regional Logging: Automatically captures management events across all active AWS Regions and newly enabled Regions.
• Global Services: Logs non-regional services (IAM, STS, Route 53, CloudFront) to a designated home region.
• Centralized Log Archive: Delivers .json.gz log files to an isolated S3 bucket in a dedicated Log Archive account.

Encryption & Log File Integrity Validation

Audit trails must be protected against tampering and unauthorized deletion:

• KMS Customer Managed Key (CMK): Encrypts logs using SSE-KMS, restricting decryption permissions strictly to security audit roles.
• S3 Object Lock: Enforces Compliance Mode (WORM—Write Once, Read Many) to prevent log modification or premature deletion by any account entity.
• Digest File Validation: Every hour, CloudTrail writes a digest file (digest.json.gz) containing SHA-256 cryptographic hashes of delivered logs, the previous digest hash, and a digital signature signed by the AWS private key. Operators run aws cloudtrail validate-logs to mathematically prove logs were not altered, deleted, or injected post-delivery.

---

CloudTrail Lake: Managed SQL Audit Data Lake

Traditional log analysis required maintaining fragile pipelines: streaming S3 objects, defining AWS Glue crawlers, partitioning by year/month/day, and configuring Amazon Athena tables. AWS CloudTrail Lake replaces this overhead with a fully managed, serverless audit data lake.

Event Data Stores (EDS) & Retention

An Event Data Store (EDS) aggregates audit events across an AWS Organization:

• Ingests management events, S3/Lambda data events, and external partner events (via PutAuditEvents).
• Supports immutable retention periods from 7 days up to 10 years (3,653 days), satisfying strict regulatory mandates (SEC Rule 17a-4, HIPAA, SOC 2).
• Eliminates ETL pipelines, Glue catalog schemas, and Athena workgroup management.

Forensic Investigations with ANSI SQL

CloudTrail Lake allows operators to run standard ANSI SQL queries directly against years of audit telemetry to identify security incidents and operational errors.

Querying Unauthorized Operations and Denied Access

To identify brute-force enumeration or misconfigured automation, CloudOps engineers query for unauthorized error codes:

SELECT
    eventTime,
    eventName,
    userIdentity.arn AS principal_arn,
    sourceIPAddress,
    errorCode,
    errorMessage
FROM
    eds-3910ab38-9a2c-4720-bd81-fbc382901a8d
WHERE
    eventTime > '2026-09-01 00:00:00'
    AND errorCode IN ('AccessDenied', 'Client.UnauthorizedOperation')
ORDER BY
    eventTime DESC
LIMIT 100;

Detecting Anomalous Regional Spikes

Adversaries with compromised credentials often launch unauthorized GPU or mining instances in remote regions. SQL queries aggregate activity outside approved operating boundaries:

SELECT
    awsRegion,
    eventName,
    userIdentity.principalId,
    COUNT(*) AS call_count
FROM
    eds-3910ab38-9a2c-4720-bd81-fbc382901a8d
WHERE
    awsRegion NOT IN ('us-east-1', 'us-west-2')
GROUP BY
    awsRegion, eventName, userIdentity.principalId
ORDER BY
    call_count DESC;

---

IAM Access Analyzer: External vs. Unused Access Analysis

AWS IAM Access Analyzer uses automated reasoning (mathematical logic theorem proving) to evaluate permissions across two critical operational domains:

1. External Access Analyzer (Resource Exposure Monitoring)

Evaluates resource-based policies to identify resources accessible to principals outside a defined Zone of Trust (an AWS account or entire AWS Organization).

• Supported Resources: Amazon S3 buckets, IAM role trust policies, AWS KMS keys, Amazon SQS queues, AWS Secrets Manager secrets, AWS Lambda functions, and Amazon ECR repositories.
• Findings: Highlight the external principal, actions permitted, and existing condition constraints, enabling teams to remediate unintended public or cross-account exposures before incidents occur.

2. Unused Access Analyzer (Enforcing Least Privilege)

Continuously reviews IAM identities to locate stale permissions and inactive credentials:

• Unused Roles: Roles not assumed within a defined window (e.g., 90 days).
• Unused Access Keys: Active keys with no signed API requests in >90 days.
• Unused Passwords: Console users who have not logged in within the tracking period.
• Unused Actions: Identifies specific permissions in policies that were never exercised.
• Automated Policy Generation: Access Analyzer can inspect an identity's CloudTrail event history over the prior 90 days and automatically generate a fine-grained, least-privilege IAM policy.

---

IAM Policy Simulator & IAM Credential Report

CloudOps engineers use two specialized tools to validate permissions and audit credential hygiene:

IAM Policy Simulator

Tests and troubleshoots effective permissions for IAM users, groups, and roles before deploying policy changes to production.

• Simulates interactions between identity policies, resource policies, permissions boundaries, and AWS Organizations Service Control Policies (SCPs).
• Validates context variables (e.g., verifying access succeeds with corporate aws:SourceIp or fails when aws:MultiFactorAuthPresent is false).
• Non-destructive execution tests policies without making actual AWS API calls.

IAM Credential Report

A downloadable, account-wide CSV audit artifact that summarizes the state of all credentials across every IAM user:

Generated via aws iam generate-credential-report and retrieved with aws iam get-credential-report, this report is essential for compliance audits (SOC 2, ISO 27001) and automated credential pruning.