Checks

CloudTrail trails include S3 object-level data events for write (or all) operations across all current and future buckets, via classic or advanced selectors. This records actions like PutObject, DeleteObject, and multipart uploads at the object level.

CloudTrail activity is analyzed for AWS identities executing a broad mix of discovery APIs like List*, Describe*, and Get* within a recent time window.

An identity exceeding a configurable ratio of these actions indicates potential enumeration behavior by that principal.

CloudTrail Bedrock activity is analyzed per identity for a high diversity of LLM-related API calls (e.g., InvokeModel, InvokeModelWithResponseStream, GetFoundationModelAvailability). If an identity's share of these actions exceeds a configured threshold over a recent window, it is surfaced as potential LLM-jacking behavior.

CloudTrail activity is analyzed for identities executing high-risk actions linked to privilege escalation (e.g., Attach*Policy, PassRole, AssumeRole, CreateAccessKey). Identities exceeding a configurable share of such events within a recent time window are highlighted for investigation.

Amazon CloudWatch metric alarms are evaluated for actions configured for the ALARM state. The finding flags alarms that have no action to execute when their monitored metric crosses its threshold.

CloudWatch metric alarms are evaluated for alarm actions activation (actions_enabled: true), enabling state changes to invoke configured notifications or automated responses.

CloudTrail records for Network ACL changes are matched by a CloudWatch Logs metric filter with an associated alarm for events like CreateNetworkAcl, CreateNetworkAclEntry, DeleteNetworkAcl, DeleteNetworkAclEntry, ReplaceNetworkAclEntry, and ReplaceNetworkAclAssociation.

CloudWatch log metric filters and alarms for network gateway changes are identified by matching CloudTrail events such as CreateCustomerGateway, DeleteCustomerGateway, AttachInternetGateway, CreateInternetGateway, DeleteInternetGateway, and DetachInternetGateway in log groups that receive trail logs.

VPC route table changes are captured from CloudTrail logs by a CloudWatch Logs metric filter with an associated alarm for events like CreateRoute, CreateRouteTable, ReplaceRoute, ReplaceRouteTableAssociation, DeleteRoute, DeleteRouteTable, and DisassociateRouteTable.

CloudTrail events for VPC configuration changes are captured in CloudWatch Logs with a metric filter and an associated alarm. The filter targets actions like CreateVpc, DeleteVpc, ModifyVpcAttribute, and VPC peering operations to surface when network topology is altered.

Amazon CloudWatch cross-account sharing via the CloudWatch-CrossAccountSharingRole allows other AWS accounts to view your metrics, dashboards, and alarms. The presence of this role indicates that sharing is active.

Log groups holding Bedrock AgentCore agent telemetry have an active CloudWatch Logs data protection policy, so sensitive data an agent writes to its own logs is masked at ingestion. A policy attached to the log group or inherited from an account-level policy both satisfy this.

CloudWatch log groups are assessed for at-rest encryption by checking if an AWS KMS key is associated with the log group via kmsKeyId.

CloudWatch Logs log groups are analyzed for potential secrets embedded in log events across their streams. Detection flags patterns resembling credentials (API keys, passwords, tokens, keys) and reports the secret types and where they appear within the log group.

CloudWatch Log Groups with resource policies that grant access to any principal are identified. Statements using Principal:"*" or wildcard Resource that reference a log group ARN indicate that the log group is exposed through a public policy.

CloudWatch Log Groups are assessed for a retention period at or above the configured threshold (e.g., 365 days) or for being set to never expire. Log groups with shorter retention are identified.

CloudTrail logs in CloudWatch Logs are inspected for a metric filter and alarm that track AWS Config configuration changes, specifically StopConfigurationRecorder, DeleteDeliveryChannel, PutDeliveryChannel, and PutConfigurationRecorder events from config.amazonaws.com.

CloudTrail logs include a metric filter for trail configuration events (CreateTrail, UpdateTrail, DeleteTrail, StartLogging, StopLogging) with an associated CloudWatch alarm to alert on matches.

Evaluates the presence of this filter-and-alarm monitoring.

CloudWatch Logs metric filter and alarm for AWS Management Console authentication failures, sourced from CloudTrail (eventName=ConsoleLogin, errorMessage="Failed authentication").

Identifies whether these failures are converted into a metric and actively monitored by an alarm.

CloudWatch Logs metric filters and alarms monitor AWS Organizations change events recorded by CloudTrail, including actions like CreateAccount, AttachPolicy, MoveAccount, and UpdateOrganizationalUnit.

The evaluation looks for a filter on the trail log group matching organizations.amazonaws.com events and an alarm linked to that metric.

CloudTrail events delivered to CloudWatch are evaluated for a metric filter and alarm that monitor KMS CMK state changes, specifically DisableKey and ScheduleKeyDeletion from kms.amazonaws.com.

CloudTrail logs are assessed for a CloudWatch metric filter matching S3 bucket configuration changes (ACL, policy, CORS, lifecycle, replication; e.g., PutBucketPolicy, DeleteBucketPolicy) and for an associated CloudWatch alarm.

CloudWatch uses a metric filter and alarm to track IAM policy changes recorded by CloudTrail (e.g., CreatePolicy, DeletePolicy, version changes, inline policy edits, policy attach/detach). This finding reflects whether that filter and an associated alarm are present on the trail's log group.

CloudTrail logs in CloudWatch include a metric filter for root account activity ({ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }) and a linked CloudWatch alarm that triggers when the filter matches.