Reconstruct what a credential could reach and what it did

applied · 80 min · Objective 6.3

Task

Answer the two separate questions an incident demands: the blast radius from the permissions, and the actual activity from the audit log. Then close the route and verify it is closed.

Steps

  1. Create a scratch identity with a deliberately over-broad policy. Enumerate its BLAST RADIUS from the policy alone -- every action on every resource it could take -- and record it in lab/ir/radius.md.
  2. Generate realistic activity with it over several minutes: a burst of list and describe calls across services, a resource created in an unusual location, and a new credential created. Then stop.
  3. Now investigate from the AUDIT LOG only, without referring to what you did. Reconstruct the timeline into lab/ir/timeline.md: first activity, every action taken, anything created, and anything read.
  4. Compare your reconstruction against what you actually did, and record what the log did NOT capture. That gap is a finding about your logging, not about the incident.
  5. Remove the persistence -- the created credential and the created resource -- narrow the policy to least privilege, and verify by attempting one of the previously-possible actions and capturing the refusal.

Verify

grep -Eci 'blast radius|could' lab/ir/radius.md
grep -Ec '[0-9]{2}:[0-9]{2}' lab/ir/timeline.md
grep -Eci 'created' lab/ir/timeline.md
grep -Eci 'gap|not captured|missing' lab/ir/timeline.md

A timestamped timeline and an explicit statement of what the logs missed. The enumeration burst should be visible and recognisable -- broad, shallow calls across many services is the clearest early signal there is.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.