# Detecting Failed Sign In Attempts to AWS and Alerting

DevFeed: [Detecting Failed Sign In Attempts to AWS and Alerting](<https://devfeed.tech/articles/detecting-failed-sign-in-attempts-to-aws-and-alerting-18007.md>)

Original publisher: [Read original article](<https://blog.guilleojeda.com/detecting-failed-sign-in-attempts-to-aws-and-alerting>)

Author: Guillermo Ojeda

Published: 2023-10-26T15:26:47Z

Content type: tutorial

Language: en

Sources: [Guille Ojeda](<https://devfeed.tech/sources/guille-ojeda.md>)

Topics: [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Security](<https://devfeed.tech/topics/security.md>), [cloud security](<https://devfeed.tech/topics/cloud-security.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [aws-iam](<https://devfeed.tech/tags/aws-iam.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [password](<https://devfeed.tech/tags/password.md>), [phishing](<https://devfeed.tech/tags/phishing.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

A tutorial describes detecting failed AWS sign-in attempts caused by failed MFA checks and using AWS CloudTrail event logs to investigate authentication activity. It explains that CloudTrail records requests from the AWS Console, CLI, SDKs, and APIs, and that trails can export events to Amazon S3 or CloudWatch Logs for analysis.

## Source excerpt

Note: This content was originally published at the Simple AWS newsletter. Imagine this scenario: You're careful with security, and you set up Multi-Factor Authentication for your AWS IAM or IAM Identity Center user. At one point, a malicious agent of...