VP-08 · Cloud and SaaS forensics

A leaked AWS key and a storage leak: CloudTrail, S3 access logs and a public bucket

1,651 CloudTrail records, 1,021 S3 server access log lines and an IAM credential report for one AWS account over two and a half days, with the code host's notice in local time. Sixteen questions follow a build key from a public repository to a role session, 294 customer contracts read, a bucket made public, an archive downloaded by three outside addresses, a second key left behind and a refused attempt to stop the trail.

Synthetic training data. The organisation, people, devices, serial numbers and times are invented.

01Brief

Lodos Lojistik A.S. runs its customer portal on AWS (account 111122223333, eu-central-1). Its build pipeline deploys with the IAM user ci-deploy from the runner address 192.0.2.40; the user's access key has not been rotated since June 2024. In the night of 7 to 8 August 2026 a code host warned that the key had been published in a public repository. Before containment at 09:05 UTC on 8 August, an examiner exported CloudTrail, the S3 server access logs of two buckets and the IAM credential report. The notice is in local time.

Internal audit asks:

Was the key used by anyone other than the pipeline, and how soon after it was published?
Which customer files left the account, by which path, and who downloaded them?
What did the session leave behind, and what did it try and fail to do?

Answer from the files only. Name keys, sessions, addresses, buckets and objects; do not name a person or a group behind the outside addresses. The repository, the outside hosts and the contents of the objects were not examined.

02Evidence files

File	Contents	SHA-256
README.txtScenario and file list	The brief in English and Turkish, the rules and the file list.	5545426a73956f1bffc9296ebae483a43cf61896fedfe87914d9509b81fdfc94
acquisition-log.txtCollection log	What was collected, when and with which role, the containment steps after the window, and the known addresses of the pipeline, the office and the portal.	10988ea8dea162058f2ae846427482cb52d5dedc57360ac09a3f2fb848cef9af
export-metadata.txtExport parameters	Window, row count, time basis and scope of the four exports. Read it first: CloudTrail data events cover one bucket only.	8854e417500bcef8af248e1878a924d40f5df16ce49e96acaa63ae4d4c729315
cloudtrail-events.jsonlCloudTrail records	1,651 records, one JSON object per line, in UTC: management events for every region and S3 data events for lodos-musteri-arsiv.	9f0d1571cbec7b2d862758879579bc44b6855c80c122004e2918611fe882b341
s3-access-logs.logS3 server access logs	1,021 access log records of lodos-musteri-arsiv and lodos-yedek-paylasim in UTC, including unauthenticated requests.	f222b86325e2d4e4a5b47ea60edf0c151ee2ba2d02667c99e1f56aee034929f4
iam-credential-report.csvIAM credential report	Seven principals at 08:40 UTC on 8 August: passwords, MFA, both access keys, when each was created and last used.	7f06b2e5745c775354c5e06fe384fed6c498599d67eb4073d2d1c645aa3a0e46
gizli-anahtar-uyarisi.txtSecret scanning notice	The code host's e-mail: repository, file, commit, push time and detection time, in local time with no zone written.	748c68871ebde473e9bc8f15a97a492d738be7e65526f1530a51833d3ade1139
manifest.txtHash manifest	SHA-256 of every file above except itself. Verify before you start.	(the manifest itself)

The hashes above are copied from manifest.txt. Recompute them yourself, for example with the hash tool or sha256sum.

You can also examine these files on the examination workbench: hashes, one UTC timeline, sessions and a findings draft in the browser.

03Before you start

Verify every file against manifest.txt and write the result in your examination log before you read anything else.
Write the time basis next to every time you copy out. The exports are UTC; the notice is local time.
Follow access key IDs, not user names: a role session has its own key, issued in an AssumeRole record.
Count objects by key and only where the request succeeded. Write the filter you used next to every number.

Keep your notes in F-02 Evidence intake form and F-04 Examination log.

04Questions

Answer from the files only. Each answer is checked in this browser; nothing is sent anywhere, and your answers are kept on this device until you clear them. 16 questions, 30 points.

Score 0 / 30

05Your finding

Last step: write one paragraph that answers the three audit questions as a finding. Your instructor marks it against four criteria:

Every time carries its basis; the notice is converted from local time.
The report follows access key IDs through AssumeRole and says how the role session is tied to the leaked key.
Objects are counted by key and only where the request succeeded; refused requests are reported as attempts.
The report states the data event scope and uses the access log for the bucket CloudTrail does not cover.
Containment covers both keys, the role's trust policy, the public bucket and the three downloading addresses.

How findings are phrased →

Representative image. The pack files are synthetic.

At a glance

Pack: VP-08
Area: Cloud and SaaS forensics
Level: Advanced
Time: 150 minutes
Questions: 16 · 30 points

You should be able to

CloudTrail records: userIdentity (IAMUser, AssumedRole, AWSService), eventSource, eventName, errorCode, management and data events.
AWS STS AssumeRole: a role session gets its own temporary access key, returned in responseElements.
The Amazon S3 server access log format: bracketed time, requester, operation, key, status and authentication type.
Filtering JSON lines with jq, a script or the ZEKASTRA workbench.

Instructors

Session plan, answer key with explanations, scoring and debrief notes. Contains the answers.

Open the instructor page →

VP-08 · A leaked AWS key and a storage leak: CloudTrail, S3 access logs and a public bucket

Name: ______________________ Date: ____________ Start / end (UTC): ________ / ________

Synthetic training data. Answer from the files; for each answer write the file and row that supports it.

Q01 (1 pt) On a copy of cloudtrail-events.jsonl, compute the SHA-256 value, compare it with manifest.txt, and enter the first 8 hex characters.
Answer: ____________________________________________
Source (file, row): ________________________________
Q02 (2 pt) When did ci-deploy's key AKIAEXAMPLECIDEPLOY1 first sign a request from an address other than the runner 192.0.2.40? UTC.
Answer: ____________________________________________
Source (file, row): ________________________________
Q03 (2 pt) How many whole minutes passed between the push that published the key and that first outside request?
Answer: ____________________________________________
Source (file, row): ________________________________
Q04 (2 pt) How many requests signed with AKIAEXAMPLECIDEPLOY1 from 203.0.113.50 were refused (the record carries an errorCode)?
Answer: ____________________________________________
Source (file, row): ________________________________
Q05 (1 pt) Which IAM role did the outside address assume with the user's key?
Answer: ____________________________________________
Source (file, row): ________________________________
Q06 (2 pt) Which temporary access key ID did that role session receive?
Answer: ____________________________________________
Source (file, row): ________________________________
Q07 (2 pt) The GetObject records of the night name the role, not ci-deploy. What ties them to the leaked key?
- ☐ A. Nothing: a role can be used by anyone in the account, so the reads cannot be attributed.
- ☐ B. The session name backup-audit, which only the attacker could have chosen.
- ☐ C. Their userIdentity.accessKeyId is the temporary key issued in the AssumeRole record that ci-deploy's key signed from 203.0.113.50 at 21:11:27, and they come from the same address with the same user agent.
- ☐ D. The bucket name: only ci-deploy uses lodos-musteri-arsiv.
Source (file, row): ________________________________
Q08 (2 pt) How many distinct objects did the session ASIAEXAMPLEDATAOPS01 read successfully from lodos-musteri-arsiv?
Answer: ____________________________________________
Source (file, row): ________________________________
Q09 (2 pt) The session's 24 GetObject requests under kimlik-belgeleri/ were refused with an errorMessage about kms:Decrypt. What should the report say?
- ☐ A. That the identity documents were read, because the request reached the bucket.
- ☐ B. That 24 identity documents were requested and not returned: they are encrypted with a KMS key the role may not use. They count as attempted, not as disclosed.
- ☐ C. Nothing, because refused requests are noise.
- ☐ D. That the KMS key was deleted during the incident.
Source (file, row): ________________________________
Q10 (2 pt) When did the session make lodos-yedek-paylasim readable by anyone? Give the time of the call that did it, UTC.
Answer: ____________________________________________
Source (file, row): ________________________________
Q11 (2 pt) CloudTrail has no PutObject into lodos-yedek-paylasim during the night. What do you conclude?
- ☐ A. Nothing was uploaded there, so the public policy exposed only the auditor's files.
- ☐ B. The trail was stopped while the upload happened.
- ☐ C. Data events are selected for lodos-musteri-arsiv only, so uploads to this bucket cannot appear in CloudTrail. Its server access log records three PUT requests by the session from 22:03:15, the parts of disa-aktarim/arsiv-0807.
- ☐ D. The uploads were made with presigned links, which are never logged.
Source (file, row): ________________________________
Q12 (2 pt) When was a part of the archive first downloaded without authentication? UTC.
Answer: ____________________________________________
Source (file, row): ________________________________
Q13 (2 pt) From how many distinct addresses were the archive parts downloaded without authentication?
Answer: ____________________________________________
Source (file, row): ________________________________
Q14 (2 pt) Which access key did the leaked key create for ci-deploy?
Answer: ____________________________________________
Source (file, row): ________________________________
Q15 (2 pt) At 22:21:40 the leaked key called cloudtrail:StopLogging on lodos-org-trail. What happened to logging?
- ☐ A. It stopped, so everything after 22:21:40 is missing.
- ☐ B. It continued: the call was refused with AccessDenied, as was DeleteTrail after it, and the trail keeps recording through the next morning.
- ☐ C. It paused for the session's lifetime and resumed automatically.
- ☐ D. It cannot be known, because a refused call is not recorded.
Source (file, row): ________________________________
Q16 (2 pt) Which sentence could the examiner sign from these files alone?
- ☐ A. The pipeline engineer used the build key to steal the contracts, since every request was signed by ci-deploy.
- ☐ B. The trail was stopped at 22:21 and the extent of the leak cannot be determined.
- ☐ C. Four minutes after the key AKIAEXAMPLECIDEPLOY1 was pushed to a public repository (20:58:41 UTC on 7 August), it signed requests from 203.0.113.50, assumed lodos-data-ops and the session ASIAEXAMPLEDATAOPS01 read 294 contracts from lodos-musteri-arsiv; 24 identity documents were refused. The session made lodos-yedek-paylasim public at 21:59:30 and uploaded a three-part archive that three addresses downloaded without authentication from 22:20:41. The key created AKIAEXAMPLECIDEPLOY2, used at 06:12 on 8 August from 203.0.113.51; its attempt to stop the trail was refused.
- ☐ D. No customer data left the account, because CloudTrail shows no upload to an outside bucket.
Source (file, row): ________________________________

Finding paragraph

______________________________________________________________________

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.

Contact page →