All news with #aws cloudtrail tag

🔒 Amazon Quick introduces approval policies that give administrators governance over how assets are shared within an organization. Administrators can require designated approvers to review and approve share requests before access is granted, ensuring sharing of sensitive assets is deliberate, compliant, and auditable. Policies can be scoped to asset types like knowledge bases, spaces, and custom chat agents, and events are recorded in AWS CloudTrail for auditability.

🔒 Administrators can now enforce approval policies in Amazon Quick to govern how assets are shared across their organization. Policies can be scoped to asset types such as knowledge bases, spaces, and custom chat agents, routing share requests to designated approver groups. Approvers can inspect assets (including full dependency packages for custom agents) and approve or deny requests, while all actions are logged to AWS CloudTrail for auditability. The capability is available on Professional and Enterprise plans in Regions that support Amazon Quick agentic features.

🔒 Amazon Managed Streaming for Apache Kafka (MSK) now supports Authorizer Log Delivery for Provisioned clusters, including Standard and Express brokers, at no additional cost. This feature captures denied authorization requests with client IP and attempted API, helping identify client authorization issues and satisfy security requirements. Logs can be delivered to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose, and can be enabled via the MSK console or AWS CLI. Authorizer Log Delivery is available for new and existing Provisioned clusters in all supported Regions except the AWS European Sovereign Cloud (eusc-de-east-1).

🛡️ This post shows how AWS DevOps Agent accelerates root-cause analysis for AWS Network Firewall issues by correlating CloudWatch alarms, firewall logs, route tables, and CloudTrail events. It walks through three reproducible failure scenarios—domain deny list, stateless rule priority inversion, and asymmetric cross-AZ routing—deployed via an AWS CDK app. The CDK stack includes a sample workload, test endpoint, status page, and a webhook pipeline so alarms trigger investigations and the agent returns mitigation plans for operator review.

📣 AWS Lambda now sends logs for Lambda Managed Instances (LMI) capacity providers to Amazon CloudWatch Logs, providing visibility into scaling activity and instance lifecycle operations. LMI lets you run Lambda functions on Amazon EC2 instances while keeping serverless operational simplicity. Capacity provider logs capture structured JSON lifecycle events like launches, terminations, and health checks to help monitor, troubleshoot, and optimize managed EC2 resources. Logs are enabled by default across supported AWS Commercial Regions and incur standard CloudWatch Logs charges.

🔍 Today AWS announced enhanced CloudTrail filtering for VPC endpoint network activity events, allowing selectors that filter logs by the IAM user identity making API calls. This update lets customers log only relevant events — for example, access denied actions from identities outside a trusted list — reducing logging noise and cost. The feature supports console, CLI, and SDK access and is available in all Regions that support CloudTrail network activity events.

🔍 Amazon CloudWatch Logs now offers intelligent storage tiering across three tiers — Standard, Infrequent Access, and Archive Instant Access — automatically classifying log data based on access patterns. This feature lets you retain high-volume verbose logs natively in CloudWatch at lower cost without operational overhead, while preserving the same query experience regardless of tier. Data not accessed for 30 days moves to Infrequent Access and for 90 days to Archive Instant Access; accessing older data promotes it back to Standard for 30 days. Intelligent-tiering is available in all AWS commercial regions except Bahrain and UAE and can be enabled at the account level via Console, SDKs, or CLI.

🛡️ AWS Certificate Manager (ACM) now offers a fully managed ACME server endpoint that issues public TLS certificates with 45-day validity from Amazon Trust Services, compatible with any ACMEv2 client such as Certbot, cert-manager, and acme.sh. PKI teams can create managed ACME endpoints with domain scopes, wildcard controls, and delegated issuance without sharing DNS credentials. Domain validation is performed once at the endpoint level, and issuance and renewal activities are auditable via the ACM console, AWS CloudTrail, and Amazon CloudWatch. ACME support is available in all commercial AWS Regions; see ACM pricing and documentation for details.

🔔 Amazon CloudWatch now lets you create alarms directly from log queries, enabling anomaly alerts without leaving the log analysis workflow. You can set thresholds on query results without first creating metric filters or custom metrics, simplifying monitoring and alerting. Alarms support standard CloudWatch actions such as Amazon SNS notifications and Amazon EventBridge integrations, and are available in all commercial AWS Regions except UAE and Bahrain. Configure these alarms via the CloudWatch console, AWS CLI, CloudFormation, or AWS SDKs.

🚀 Amazon Elastic Container Service (Amazon ECS) now offers real-time deployment observability within the Amazon ECS Console. This update enables customers to track deployment progress, monitor health, and diagnose failures directly in the console with a live deployment timeline, circuit breaker and alarm status, and container and load-balancer health checks. Failed tasks surface with diagnostic context and deep links to related services like AWS CloudTrail. These features are available at no additional charge in all AWS commercial Regions and AWS GovCloud (US) for services using the rolling update deployment type.

🚀 Amazon CloudWatch now offers OTel Container Insights for Amazon EKS, collecting infrastructure metrics at 30-second granularity using open-source receivers like cAdvisor, Kube State Metrics, and NVIDIA DCGM. Each metric includes OpenTelemetry semantic conventions and Kubernetes labels to simplify correlation across nodes, pods, and workloads with a single PromQL query. Pre-built dashboards provide immediate visibility into cluster health, node performance, and pod-level resource usage, and the CloudWatch PromQL endpoint enables direct connection of existing Prometheus and Grafana dashboards. Enable the feature from the EKS console, the CloudWatch Observability add-on (v6.2.0+), Helm, or CloudFormation; it is available in all commercial AWS Regions except UAE, Bahrain, and Israel (Tel Aviv).

🔐 This post shows how Kiro CLI, an AI-powered command line assistant, speeds AWS security investigations by proposing, explaining, and optionally executing AWS CLI commands while documenting each step. It demonstrates a GuardDuty-driven investigation following the AWS Security Incident Response Guide: triage, EC2 and IAM assessment, CloudTrail analysis, containment, and remediation. The walkthrough highlights benefits like faster triage, automated CloudTrail queries, and guided remediation, while advising human validation and forensic preservation.

🔎 This post explains how subdomain takeover occurs when dangling DNS CNAME records point to deleted AWS resources and how attackers can reclaim those names to serve malicious content. It describes which AWS services use globally claimable namespaces (notably S3, CloudFront, and Elastic Beanstalk), outlines potential impacts such as reputation damage and phishing, and recommends detection using AWS Config inventory checks rather than DNS resolution. The article also summarizes a reference implementation that deploys a Lambda-based Config rule, Security Hub findings, optional SNS alerts, and mitigation best practices including deleting DNS records before resources and adopting account regional S3 namespaces where applicable.

🔍 Cloud logging services like AWS CloudTrail and Google Cloud Logging offer essential visibility into cloud activity but are also high-value targets for attackers. This article examines two primary attack goals—defense evasion and establishing continuous visibility—and demonstrates methods attackers use to disrupt or exfiltrate logs. It outlines practical attack techniques such as stopping logging, deleting storage or routers, abusing encryption keys, and log poisoning, and highlights detection and mitigation approaches.

🛡️ This post explains how AWS Shield Advanced attack flow logs capture metadata during DDoS events and publish records to Amazon S3, CloudWatch Logs, or Data Firehose. It outlines the fields included in each flow log entry, describes delivery configuration and required IAM permissions, and shows how to create the CloudWatch Logs delivery objects that connect a Shield protection to a destination. The article also covers output formats, file size and timing, cost considerations, and cross-account/Region aggregation options.

🟣 Amazon EKS Capabilities can now be configured as log delivery sources using Amazon CloudWatch Vended Logs to capture logs from managed controllers such as Argo CD, AWS Controllers for Kubernetes (ACK), and kro. Customers can enable delivery via CloudWatch APIs or the AWS Console and send logs to CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose. The feature is available in all Regions that support EKS Capabilities and incurs standard CloudWatch Vended Logs pricing with no additional EKS charge.

🔍 AWS IoT Core now emits two new Amazon CloudWatch Log event types to help troubleshoot device connectivity and authentication across IoT fleets. The Ping log captures MQTT Keep‑alive messages to identify connections or devices that fail to maintain connectivity. The Connection.AuthNError log records rejected connection attempts with detailed error codes to speed resolution of credential and certificate issues. Enable event-level logging and choose a CloudWatch log group, then opt into these event types; they are available in all AWS Regions where AWS IoT Core operates.

🔔 AWS Organizations now emits CloudTrail events to the management account when member accounts join or leave an organization, introducing two new events: AccountJoinedOrganization and AccountDepartedOrganization. The join event records method (Created or Invited) and timestamp, while the depart event records mode (Left, Removed, or Cleaned) and timestamp. Administrators can use these events with CloudWatch alarms or EventBridge rules to enable real‑time notifications and faster incident response.

🔒 The AWS Customer Incident Response Team (CIRT) is a 24/7 global team that helps customers during active security events affecting the customer side of the Shared Responsibility Model. The team analyzes AWS service logs and the control plane using sources like AWS CloudTrail, VPC Flow Logs, and GuardDuty, provides triage and containment guidance, and recommends follow-up actions. AWS also publishes tools, workshops, and the Threat Technique Catalog for AWS (TTC) to help customers prepare and detect recurring tactics and techniques.

🔒 The AWS Customer Incident Response Team describes a tactic where attackers use credentials with the organizations:LeaveOrganization permission to remove a member account from an AWS Organization, bypassing inherited safeguards such as Service Control Policies and centralized management. After removal, the account is disentangled from consolidated billing, organization-wide CloudTrail trails, and delegated GuardDuty findings, reducing visibility. The post urges deploying the DenyLeaveOrganizationSCP, enforcing least privilege, securing root users with MFA and centralized root management, and updating detection and response workflows to monitor related CloudTrail events.