AWS Security Incident Response: Tracking Attackers Through Audit Logs

AWS Security Incident Response: Tracking Attackers Through Audit Logs

https://knowledge.businesscompassllc.com/aws-security-incident-response-tracking-attackers-through-audit-logs/

A suspicious API call fires at 2 AM. An IAM role you don’t recognize starts spinning up EC2 instances. Your S3 bucket permissions changed — and nobody on your team did it.