01Purpose and scope
To preserve the account's control-plane record and the state of affected resources in a way that shows the files were not changed after AWS delivered them.
One or more AWS accounts, all Regions in use; access key misuse, S3 bucket exposure, unexpected instances. Memory and disk examination of an instance follow SOP-04 and SOP-06 after the snapshot.
02Prerequisites
- Written authority naming the account IDs, the Regions and the period.
- A dedicated read-only role for the examiner, separate from the responders' roles, so its own API calls are identifiable in CloudTrail.
03Steps
Map what is logged
List trails and event data stores, their Regions, whether they record data events (S3 object reads) as well as management events, and whether log file validation is enabled. Event history alone holds 90 days of management events per Region and no S3 object reads.
RecordLogging map per Region
Export event history for every Region in use
aws cloudtrail lookup-events with --start-time and --end-time in UTC, per Region; include read-only events, which the console filters out by default. Look up the leaked AccessKeyId as an attribute.
RecordCommand, Region, period, count, SHA-256
Copy trail files and validate them
Copy the trail's log and digest files for the period to an evidence bucket in another account. Run aws cloudtrail validate-logs for the trail and period: it checks each file's SHA-256 against signed digest files and reports files that were modified or deleted.
Recordvalidate-logs output kept with the copy
Capture policies and configuration as found
Bucket policy, ACLs and Block Public Access settings for the affected buckets; the IAM credential report; the users, roles and keys involved with their creation and last-used times. Remediation will change all of these.
RecordJSON exports with capture time
Collect S3 server access logs if enabled
They record object reads that CloudTrail management events do not. AWS delivers them on a best-effort basis, so a missing line is not proof that a request did not happen.
RecordLog prefix, period, object count, SHA-256 of the archive
Snapshot affected volumes before change
Create EBS snapshots of the instances involved, tag them with the case number, and share them to the evidence account. Record snapshot IDs; the image is made from the snapshot, not from the running instance.
RecordSnapshot ID, source volume, time
Record the gaps
Regions without a trail, data events not recorded, periods before the trail existed, buckets without access logging. Each gap limits what the report may say.
RecordGap statement
04Records produced
- Logging map and gap statement
- Exports and copies with SHA-256 and validate-logs output
- Snapshot register
05Pitfalls
- Deactivating a leaked key is urgent, but deleting it removes it from the credential report; deactivate, record, and delete later.
- CloudTrail event times are UTC; S3 access log times carry their own offset in the line. Do not assume a common base without reading it.
- Event history excludes read-only events by default in the console view; an export made with the default filter is incomplete.