# Incident response guide for AWS CloudTrail investigations - Part 2

DevFeed: [Incident response guide for AWS CloudTrail investigations - Part 2](<https://devfeed.tech/articles/incident-response-guide-for-aws-cloudtrail-investigations-part-2-4686.md>)

Original publisher: [Read original article](<https://aws.amazon.com/blogs/security/incident-response-guide-for-aws-cloudtrail-investigations-part-2/>)

Author: Oscar Diaz

Published: 2026-09-03T21:15:53Z

Content type: article

Language: en

Sources: [AWS Security Blog](<https://devfeed.tech/sources/aws-security-blog.md>)

Topics: [Incident response](<https://devfeed.tech/topics/incident-response.md>), [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>)

Tags: [advanced-300](<https://devfeed.tech/tags/advanced-300.md>), [amazon-bedrock](<https://devfeed.tech/tags/amazon-bedrock.md>), [aws](<https://devfeed.tech/tags/aws.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [aws-identity-and-access-management-iam](<https://devfeed.tech/tags/aws-identity-and-access-management-iam.md>), [best-practices](<https://devfeed.tech/tags/best-practices.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [security-blog](<https://devfeed.tech/tags/security-blog.md>), [security-identity-compliance](<https://devfeed.tech/tags/security-identity-compliance.md>)

## AI overview

An incident-response guide for investigating AWS CloudTrail events through a multi-stage attack scenario. It traces an SSRF vulnerability on an EC2-hosted web application to IMDSv1 credential harvesting, IAM activity, and unauthorized Amazon Bedrock access across Regions.

## Source excerpt

In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed through AWS CloudFormation using exposed AWS Management Console credentials. We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events. In this second [...]