implementing-cloud-trail-log-analysis

Create an external Athena table over the CloudTrail S3 bucket using the JSON SerDe, partitioned by region, year, month, and day. Add partitions for the target dates, then run SQL queries filtering on eventName, userIdentity, and errorCode to detect suspicious activity.

Query for IAM events like CreatePolicyVersion, AttachRolePolicy, PutUserPolicy, CreateAccessKey, and PassRole in CloudTrail. Correlate these with sourceIPAddress and userIdentity.arn to identify which principal attempted escalation and from where.

GuardDuty already analyzes CloudTrail for real-time threat detection, so use it for active alerting. CloudTrail log analysis with Athena or Logs Insights is for forensic investigation, custom detection rules, and compliance auditing rather than real-time detection.

Empty results usually mean partitions were never added for the queried dates, so Athena scanned nothing. Add partitions with ALTER TABLE ADD PARTITION pointing at the correct S3 prefix, or enable partition projection on the table.

CloudTrail delivery to S3 and CloudWatch lags up to about 15 minutes, so it is not truly real-time. For live incidents, use CloudTrail Lake or CloudWatch Logs Insights, which provide faster query access to recent events.

CIS Benchmark recommends metric filters and alarms for unauthorized API calls, root account usage, IAM policy changes, and CloudTrail configuration changes like StopLogging, DeleteTrail, and UpdateTrail. These indicate credential misuse or attempts to disable auditing.