Identify IAM Breaches with CloudTrail and Athena

A beginner-friendly, hands-on blue team lab covering AWS CloudTrail and Amazon Athena, and how these services are used to identify IAM attacks and compromised IAM users from both the AWS Console and the CLI.

As part of proactive monitoring for our client, the multinational shipping company Huge Logistics, authentication details for their internal tracking database were found leaked on a public paste site. The dump lists usernames and unencrypted passwords for the application, and the client is worried that attackers may be able to reuse this information to gain access to their cloud environment. You have been tasked with identifying any malicious IAM activity and any compromised IAM accounts, using AWS CloudTrail and Amazon Athena.

• Basic Linux command line knowledge

• Enabling and configuring AWS CloudTrail and Amazon Athena
• Using the AWS Console to query Athena
• Using the AWS CLI to query Athena

IAM brute force attacks are a real threat to the security of AWS cloud environments. Attackers frequently attempt to gain unauthorized access by repeatedly guessing IAM user credentials. Common techniques include password spraying, which uses a large number of potential users and a small number of passwords, and credential stuffing, where many username and password combinations are attempted. In both cases, tools are used to automate the attacks.

AWS CloudTrail, which logs account activity, combined with Amazon Athena's querying capability, forms an effective defense mechanism. Together they allow security professionals to rapidly analyze logs for suspicious patterns, such as repeated failed and successful login attempts, helping to identify potential IAM breaches or ongoing brute force attacks.