Welcome back to Backspace Academy. AWS CloudTrail it doesn't have a broad set 2
of features like other AWS services but what it does is extremely important and 3
it may well be your last line of defense in the event that your infrastructure is 4
breached. Now imagine you've had your email 5
account compromised and an attacker has got hold of your username and password 6
from something like an email phishing attack or something like that. In that 7
situation it doesn't matter how good your Linux firewall is, your security 8
groups, your network access control lists, all of that sort of thing, it's not going 9
to really help in that situation because your attacker has access with valid 10
credentials and, in that situation you need to identify that an attack is 11
occurring from within your infrastructure, not from outside of your 12
infrastructure, and that is where Cloudtrail comes in to help you identify 13
unusual activity from inside of your accoun. Cloudtrail it provides a record 14
of AWS API calls to your AWS account. So if you've got multiple AWS users that 15
you've setup IAM users, what it will do is it will record all of the interactions 16
between that user and your AWS account by recording all of those API calls that 17
are made. The record will consist of the actual user the timestamp that the API 18
call was made, the actual API call it could be a call to the ec2 service or s3 19
service whatever that is, the resources involved it could be a 20
bucket or an ec2 instance or whatever and, the region that the call was made to. 21
Now as we explained previously this is really important from a security 22
perspective especially if you have an attack that 23
occurs from within your account. So if someone has valid credentials that 24
they've somehow acquired or stolen or whatever and they have access to your 25
account and they're inside of your AWS account. So it allows you to record 26
what's going on there and be alerted to situations that may be unusual. It can be 27
used for compliance to standards by making sure that you record all of the 28
interaction between your users and your account and recording that and archiving 29
that if needed. It's also very good for troubleshooting your infrastructure, for 30
example you may find a situation where a individual user has difficulty, so you 31
can go through your cloudtrail logs and see what API calls that that user is 32
making and, why that individual user is having problems with your infrastructure. 33
The cloud trail records are saved to Amazon S3 in JSON format and they're 34
encrypted using s3 server-side encryption. Cloudtrail can also be 35
integrated with Cloudwatch logs and by doing that you'll be able to see 36
activity inside of your account with these API calls in the cloud watch 37
console and you can also have alarms setup, they can trigger a message or 38
maybe even trigger a Lambda function or something like that, some sort of quick 39
interaction.You can also have it integrated with SNS and you do that 40
using the console or using the CLI create trail command. Now because the 41
Cloudtrail records are saved to Amazon s3, you can set up an s3 event 42
that can also trigger an AWS Lambda function and so that Lambda function may 43
analyze what that record entry is and just see whether that is worth alerting 44
your administrator or whatever if there is an issue. 45
OK, a picture tells a thousand words. On the left there we've got all of the 46
different ways that our users can interact with our AWS account. So they 47
could use the AWS management console and by doing that the AWS 48
management console application will then send an API call to AWS to do something 49
to an AWS service, that could be IAM, it could be Amazon S3, it could be EC2, 50
could be DynamoDB, could be any one of a number of different services or, the user could 51
use an application that is running one of the many software development kits 52
and that again would be sending API calls in or, the user could be using the 53
AWS command line interface as well but any one of those three different 54
techniques will allow the user to interact with your AWS account using 55
these API calls. Now those API calls will be picked up by Cloudtrail 56
and Cloudtrail will record basic information about that API call 57
and it will store that as a record in a Cloudtrail log and so those Cloudtrail 58
logs will be stored in a designated s3 bucket that you define and, you can also 59
integrate an SNS topic with those cloudtrail logs so when they come in it can 60
alert you with an SNS topic. You can also integrate it with cloudwatch logs and 61
by doing that you've got all of those features of cloudwatch then as well and 62
so that will allow you to integrate a cloudwatch alarm or you could or even 63
have your cloudwatch logs sent over to a Kinesis stream as well for live 64
monitoring of that cloudtrail log. Now when you open up a cloudtrail log it 65
will consist of a whole heap of JSON records. So here we've got an example of 66
what one of those records for an individual API call looks like. So we've 67
got an IAM user who is not multi-factor authenticated, who is logged into the 68
account. They've gone to the ec2 service and 69
they've created a new key pair for an ec2 server. Now this is something that 70
you may want to be alerted to. You may not want people that are not MFA 71
authenticated to be able to create new encryption key pairs. 72
Now as we've seen in the previous slides CloudTrail can integrate with some 73
other services. It can integrate with S3 events to trigger some reactive 74
action to be taken it can integrate with CloudWatch logs and then integrate 75
with Kinesis streams. So there's a whole range of different things that you can 76
create yourself to be proactive to actually analyze and react to this 77
CloudTrail information but, there is also 78
CloudTrail Insights which is an out-of-the-box service provided by AWS. What that will do is 79
it will track your normal patterns of API call volume. Now that can take up 80
to 36 hours for the first time to get that history that it needs to to see 81
what your normal pattern is. So you just need to take that into consideration 82
when you first create this cloudtrail insight. You're not going to be able to 83
take advantage of it until that 36 hours of normal pattern time has been has been 84
put in, and that will then generate an insight event if any of the volume is 85
outside of those normal patterns. So if your infrastructure has been attacked 86
from within using credentials then if there's a high 87
volume for certain types of activity that is not normally the pattern then 88
that will trigger a insight event and that event will be recorded as a log 89
entry and that again will be stored in Amazon S3 and so those events insights 90
events can be viewed in the cloudtrail console as a graph in a similar way that 91
you can view alarms in the cloudwatch console, and that event history which is 92
sent to Amazon s3 and stored in Amazon s3, that can be used to trigger an s3 event 93
but it can also be used to send those record information, all those event 94
information to be sent over to cloudwatch logs, from there you've got all of 95
the features that are available of cloudwatch as well. Ok so here is what a 96
Cloudtrial insights event graph looks like. So what you've got there is some normal 97
activity there in blue, and all of a sudden it spikes and around about 13:35 98
it's spiked up there and that is unusual and it's marked in red and so that has 99
triggered an insight event. So if you want to have more information about that 100
you can scroll down and go and expand the insights event record to see exactly 101
what occurred. Then you can also go into the s3 bucket have a look in there and 102
by doing that that's going to allow you to get some better information about 103
what's causing this spike in demand. Okay so that brings us to the end of a pretty 104
short lecture but a very important one on cloudtrail I hope you enjoyed it and 105
I look forward to seeing you in the next one