Answer an auditor's questions with CloudTrail, the IAM credential report and AWS Artifact

short · 30 min · Task statement 2.2

Before you start — what this lab needs, and what it can cost

This lab runs in your own AWS account, so treat every command as real. Work in AWS CloudShell, signed in as a non-root administrative identity: an IAM Identity Center user, or an IAM user with administrator permissions. Never use the root user for this lab. Everything here uses the AWS Free Tier where possible, but charges are possible, so finish the clean-up the same day; the AWS Pricing Calculator and each service's pricing page give current rates. It relies on the AWS Budgets alert you set in lesson 1's lab, which emails you if this account starts to cost money. The commands use 111122223333 as the account ID: put your own 12-digit account ID in its place every time it appears (CloudShell prints it with aws sts get-caller-identity --query Account --output text). CloudTrail event history is on in every account and keeps 90 days of management events, so this lab reads it rather than creating a trail. AWS Artifact is browsed only: you accept no agreement and no report terms in this lab.

This lab ends with a clean-up. Do it the same day: anything left running in your account is billed to you.

Task

Act as the person an auditor asks three questions: who created this bucket, and when; what state are our IAM users' credentials in; and where is AWS's own evidence for its data centres. You answer the first from AWS CloudTrail event history, the second from the IAM credential report and the third from AWS Artifact, and you finish knowing which tool answers which kind of question: actions, credentials or documents about AWS.

Steps

Create a bucket, so there is an action for CloudTrail to record:

aws s3 mb s3://clf-lab07-111122223333

CloudTrail usually shows a new event in event history within about five minutes, sometimes longer, so do steps 2 and 3 while you wait. 2. Generate the IAM credential report and save it as a CSV file in CloudShell:

aws iam generate-credential-report
aws iam get-credential-report --query Content --output text | base64 -d > report.csv
cut -d, -f1,4,8,9 report.csv

If the second command says the report is not ready, run aws iam generate-credential-report again and wait a few seconds. The four columns are the user name, whether a console password is set, whether MFA is active and whether the first access key is active. One row per IAM user is exactly what an auditor checking credential hygiene wants. 3. Open the AWS Artifact console and choose Reports. Search for SOC and read the titles and descriptions of the reports listed. These are documents about AWS, written by AWS's auditors, not reports about your resources. Then look at the Agreements tab and find the Business Associate Addendum (BAA) in the list. Read only: do not accept any terms or agreements, because accepting one is a legal act on behalf of your account. 4. Back in CloudShell, find who created the bucket:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateBucket --query "Events[?contains(CloudTrailEvent, 'clf-lab07-111122223333')].[EventTime,Username]" --output table

The user name is your own administrative identity. If the table is empty, wait a few minutes and run it again. 5. Read where the call came from, which completes the auditor's question:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateBucket --query "Events[?contains(CloudTrailEvent, 'clf-lab07-111122223333')] | [0].CloudTrailEvent" --output text | jq '.sourceIPAddress, .userAgent, .awsRegion'

That is who, what, when and from where, all from one API record. CloudTrail records actions; it would not tell you how a setting has changed over time (that is AWS Config) or how a server is performing (that is Amazon CloudWatch). 6. Match each question to its tool without running anything: a report proving AWS's PCI DSS compliance; who deleted a security group; which users have no MFA; the IP traffic reaching a network interface; an alarm when CPU passes 80 percent. The answers are in the Notes.

Verify

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=CreateBucket --query "length(Events[?contains(CloudTrailEvent, 'clf-lab07-111122223333')])"

Expected output: 1.

aws iam get-credential-report --query ReportFormat --output text

Expected output: text/csv.

Cost and clean-up

Event history, the credential report and AWS Artifact cost nothing to read. An empty bucket is within the AWS Free Tier for most accounts, but S3 requests may be charged, so delete it when you finish.

Created by this lab: the bucket clf-lab07-111122223333; the CloudShell file report.csv.

Delete the bucket, which is empty:

aws s3 rb s3://clf-lab07-111122223333

Remove the credential report from CloudShell, because it lists your account's users:

rm report.csv

The generated report in IAM expires on its own, and the CloudTrail event for CreateBucket stays in event history for 90 days. You cannot delete it, which is the point of an audit log.

Check it is gone

aws s3api list-buckets --query "length(Buckets[?Name=='clf-lab07-111122223333'])"

Expected output: 0.

Notes

Answers to step 6: AWS's PCI DSS report is in AWS Artifact; who deleted a security group is in AWS CloudTrail; users with no MFA are in the IAM credential report; IP traffic to a network interface is in VPC Flow Logs; a CPU alarm is Amazon CloudWatch. Event history covers management events in the current Region, and global services such as IAM are recorded in US East (N. Virginia). A company that must keep records beyond 90 days creates a trail that delivers log files to an S3 bucket it chooses; a trail and its bucket can be charged, which is why this lab does not create one.

This is an independent study companion for the AWS Certified Cloud Practitioner (CLF-C02) exam and is not produced by or endorsed by Amazon Web Services. AWS, Amazon Web Services and AWS Certified Cloud Practitioner are trademarks of Amazon.com, Inc. or its affiliates.

This is an independent study companion for AWS Certified Cloud Practitioner CLF-C02 and is not produced by or endorsed by CompTIA.