# AWS CloudTrail AWS service for recording and analyzing user, role, service, and API activity for auditing, governance, compliance, and security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## AWS STS simplifies session token size limits and adds session token size monitoring DevFeed: [AWS STS simplifies session token size limits and adds session token size monitoring]() Original publisher: [Read original article]() Author: Rishi Tripathy Published: 2026-09-15T22:21:59Z Content type: release Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services](), [Security](), [Monitoring](), [Amazon CloudWatch](), [AWS CloudTrail](), [API]() Tags: [advanced-300](), [amazon-cloudwatch](), [apis](), [aws](), [aws-cloudtrail](), [aws-security-token-service](), [aws-sts](), [infrastructure](), [metrics](), [monitoring](), [security](), [security-blog](), [security-identity-compliance](), [technical-how-to](), [token]() ### AI overview AWS Security Token Service has replaced its separate packed policy and overall session token limits with a single 4,096-byte limit. It now reports session token size and limit utilization in API responses, Amazon CloudWatch metrics, and AWS CloudTrail events. ### Source excerpt AWS Security Token Service (AWS STS) has simplified session token size limits, giving you more room for your session policies and session tags. STS has replaced the packed policy size and the overall session token size limits with a single token size limit of 4,096 bytes. STS now reports session token size in API responses, [...] ## Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore DevFeed: [Manage end-user OAuth consent for AI agents with Amazon Bedrock AgentCore]() Original publisher: [Read original article]() Author: Swara Gandhi Published: 2026-09-14T20:35:45Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [Amazon Bedrock AgentCore](), [OAuth](), [Amazon Web Services](), [AWS CloudTrail](), [GitHub](), [Slack](), [Model Context Protocol](), [ide]() Tags: [amazon-bedrock](), [amazon-bedrock-agentcore](), [announcements](), [aws](), [aws-cloudtrail](), [claude-code](), [cursor](), [github](), [intermediate-200](), [kiro](), [model-context-protocol](), [oauth](), [slack](), [visual-studio-code]() ### AI overview This tutorial explains how Amazon Bedrock AgentCore Identity's Consent portal manages end-user OAuth consent and session binding for AI agents. It covers configuring GitHub and Slack targets through an AgentCore Gateway, storing user tokens, supporting IDE and MCP clients, and reviewing activity in AWS CloudTrail. ### Source excerpt Amazon Bedrock AgentCore Identity now offers a Consent portal, a managed web experience and session binding endpoint for AgentCore Gateway. This post walks through provisioning a portal, configuring GitHub and Slack 3LO targets, and the end-user consent flow, and shows how to review activity in AWS CloudTrail. ## Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection DevFeed: [Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection]() Original publisher: [Read original article]() Author: Osher Jacob Published: 2026-09-14T10:00:01Z Content type: article Language: en Sources: [Unit 42]() Topics: [AWS CloudTrail](), [Cloud](), [threat detection](), [Threat Research](), [SIEM, Security, Observability](), [Machine learning](), [Algorithms](), [SQL](), [IAM](), [identity and access management](), [Amazon Web Services]() Tags: [algorithms](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [cloud](), [cloud-cybersecurity-research](), [cloud-detection](), [devops](), [iam](), [identity-and-access-management](), [logs](), [machine-learning](), [post](), [sql](), [threat-detection](), [threat-research]() ### AI overview This article presents a behavioral clustering model for mapping cloud identities to functional roles using activity patterns from audit logs. It applies unsupervised machine learning with UMAP and HDBSCAN to data from more than 40,000 identities across 125 cloud environments, and shows how the resulting map can support automated threat detection. The article also explains how lightweight heuristics extracted from the map can classify identities at scale using standard SQL, reducing the need for continuous resource-intensive machine learning pipelines. ### Source excerpt We designed a behavioral clustering model to map cloud identity roles from audit logs, enabling continuous threat detection using standard SQL queries. The post Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection appeared first on Unit 42. ## Amazon Quick is now generally available on desktop DevFeed: [Amazon Quick is now generally available on desktop]() Original publisher: [Read original article]() Author: Spencer Martenson Published: 2026-09-10T18:16:37Z Content type: release Language: en Sources: [Artificial Intelligence]() Topics: [App](), [AWS CloudTrail](), [dashboards]() Tags: [agents](), [ai](), [amazon](), [amazon-quick-suite](), [android](), [announcements](), [artificial-intelligence](), [aws](), [aws-cloudtrail](), [compliance](), [dashboards](), [ios](), [macos](), [security](), [shadow-ai](), [windows]() ### AI overview Amazon Quick's desktop application is generally available on macOS and Windows. The article describes its enterprise AI-assistant features, mobile activity feed, shared workspace, AWS-based privacy and auditing, and compliance support. ### Source excerpt Your teams get an AI assistant that handles real work while your data stays in your environment and your conversations stay private Today, the Amazon Quick desktop application is generally available on macOS and Windows. We're also adding a new activity feed to the mobile experience on iOS and Android that consolidates email, calendar, CRM, [...] ## Incident response guide for AWS CloudTrail investigations - Part 2 DevFeed: [Incident response guide for AWS CloudTrail investigations - Part 2]() Original publisher: [Read original article]() Author: Oscar Diaz Published: 2026-09-03T21:15:53Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Incident response](), [AWS CloudTrail](), [AWS IAM](), [web applications]() Tags: [advanced-300](), [amazon-bedrock](), [aws](), [aws-cloudtrail](), [aws-identity-and-access-management-iam](), [best-practices](), [incident-response](), [security-blog](), [security-identity-compliance]() ### AI overview An incident-response guide for investigating AWS CloudTrail events through a multi-stage attack scenario. It traces an SSRF vulnerability on an EC2-hosted web application to IMDSv1 credential harvesting, IAM activity, and unauthorized Amazon Bedrock access across Regions. ### Source excerpt In Part 1 of this guide, we examined two common incident scenarios: cross-account Amazon Simple Storage Service (Amazon S3) data deletion with ransomware implications, and cryptocurrency mining deployed through AWS CloudFormation using exposed AWS Management Console credentials. We also introduced key incident response terminology and investigative frameworks for analyzing AWS CloudTrail events. In this second [...] ## Incident response guide for AWS CloudTrail investigations - Part 1 DevFeed: [Incident response guide for AWS CloudTrail investigations - Part 1]() Original publisher: [Read original article]() Author: Oscar Diaz Published: 2026-09-03T21:15:39Z Content type: tutorial Language: en Sources: [AWS Security Blog]() Topics: [AWS CloudTrail](), [Incident response](), [AWS IAM]() Tags: [advanced-300](), [analysis](), [aws-cloudtrail](), [best-practices](), [guide](), [incident-response](), [logs](), [security](), [security-blog](), [security-identity-compliance]() ### AI overview A practical guide to investigating suspicious AWS activity through CloudTrail logs. It covers scenarios such as cross-account unauthorized access, cryptocurrency mining, and AI service abuse, with investigation questions, annotated logs, and preventive lessons. ### Source excerpt AWS CloudTrail logs contain the evidence you need when investigating suspicious activity in your AWS environment, but knowing which fields matter and how to interpret them can mean the difference between surface-level analysis and uncovering the full scope of an incident. This guide walks you through real-world scenarios, showing you how to analyze CloudTrail events [...] ## Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation DevFeed: [Detecting multi-stage attacks on AWS: A guide to cross-service signal correlation]() Original publisher: [Read original article]() Author: Nisha Kashyap Published: 2026-08-26T17:39:19Z Content type: article Language: en Sources: [AWS Security Blog]() Topics: [Amazon Web Services (AWS)](), [Security](), [Detection engineering](), [Amazon CloudWatch Logs](), [AWS CloudTrail](), [VPC Flow Logs](), [Amazon S3](), [data]() Tags: [advanced-300](), [amazon-cloudwatch](), [amazon-cloudwatch-logs](), [amazon-guardduty](), [amazon-route-53](), [amazon-web-services-aws](), [analysis](), [aws-cloudtrail](), [aws-security-hub](), [best-practices](), [cybersecurity](), [guide](), [incident-response](), [logs](), [s3](), [security](), [security-blog](), [security-identity-compliance](), [shared-responsibility-model](), [technical-how-to](), [threat-detection](), [vpc-flow-logs]() ### AI overview This article explains how security engineers can detect multi-stage attacks on AWS by correlating signals across services with business context. It presents examples using CloudWatch Logs Insights and discusses expanding the correlations into an automated pipeline. ### Source excerpt A single alert from one security service tells you something happened. Read that signal alongside activity from other services and your own business context, and you will know whether what happened is part of a multi-stage attack. Consider a short sequence. An identity calls GetCallerIdentity from a source address it hasn't previously used. Within minutes, [...] ## Blog: Preventing attacker persistence with Falco on AWS DevFeed: [Blog: Preventing attacker persistence with Falco on AWS]() Original publisher: [Read original article]() Published: 2024-03-11T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [Amazon Web Services](), [AWS CloudTrail](), [AWS Lambda](), [Persistence](), [Code]() Tags: [aws](), [aws-cloudtrail](), [aws-lambda](), [falco](), [incident-response](), [ip](), [lambda](), [mfa](), [persistence](), [request](), [s3](), [security-concept]() ### AI overview This article explains how an attacker could modify an existing Lex-based AWS Lambda function to disclose AWS credentials when triggered by a secret phrase. It describes using Falco's AWS CloudTrail plugin and rules to detect Lambda code updates and alert engineers for investigation. ### Source excerpt I recently read an interesting blog on how hackers could use a Lambda function alongside Lex to establish persistence in an AWS account. For those unfamiliar with the term, persistence is when attackers leverage some technique to retain access to systems without being detected. A recent news article cited a study that reported that some Chinese hackers have lurked in systems for up to FIVE YEARS! Luckily for all of us, Falco can be used to detect the exact scenario detailed in the blog and immediately raise an alert. The blog detailed how an attacker who has gained access to an AWS account could modify an existing Lex-based Lambda function to provide a set of AWS credentials. In short, the attacker modified the function of the Lex-based chatbot to respond whenever a secret phrase was entered with the Lambda's AWS key ID and secret key. The author notes there are several ways to establish persistence on AWS, and maybe this wasn't the most practical, but I still found it a fun exercise. It got me thinking: How could Falco help here? My immediate thought was to use Falco's AWS Cloudtrail plugin. The plugin, as the name implies, ingests Cloudtrail events. The events can be evaluated against a set of rules to alert engineers of any suspicious activity. There are currently just over 20 different rules that can be assessed. They include scenarios like creating new users, having someone log into the root account without MFA, changing permissions on an S3 bucket, and, most relevant to our discussion here, modifying a Lambda function. - rule: Update Lambda Function Code desc: Detect updates to a Lambda function code. condition: ct.name="UpdateFunctionCode20150331v2" and not ct.error exists output: The code of a Lambda function has been updated. (requesting user=%ct.user, requesting IP=%ct.srcip, AWS region=%ct.region, lambda function=%ct.request.functionname) priority: WARNING tags: - cloud - MITRE_TA0003_persistence - aws_lambda source: aws_cloudtrail Alternatively, you coul ## Detecting Failed Sign In Attempts to AWS and Alerting DevFeed: [Detecting Failed Sign In Attempts to AWS and Alerting]() Original publisher: [Read original article]() Author: Guillermo Ojeda Published: 2023-10-26T15:26:47Z Content type: tutorial Language: en Sources: [Guille Ojeda]() Topics: [AWS CloudTrail](), [AWS IAM](), [MFA](), [Amazon Web Services](), [Security](), [cloud security]() Tags: [aws](), [aws-cloudtrail](), [aws-iam](), [best-practices](), [mfa](), [password](), [phishing](), [security]() ### AI overview A tutorial describes detecting failed AWS sign-in attempts caused by failed MFA checks and using AWS CloudTrail event logs to investigate authentication activity. It explains that CloudTrail records requests from the AWS Console, CLI, SDKs, and APIs, and that trails can export events to Amazon S3 or CloudWatch Logs for analysis. ### Source excerpt Note: This content was originally published at the Simple AWS newsletter. Imagine this scenario: You're careful with security, and you set up Multi-Factor Authentication for your AWS IAM or IAM Identity Center user. At one point, a malicious agent of... ## Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs DevFeed: [Automate AWS Athena Partitions for Organization CloudTrail Logs and VPC Flow Logs]() Original publisher: [Read original article]() Author: Aurelien Cerveaux Published: 2022-09-15T06:39:58Z Content type: tutorial Language: en Sources: [betclic-tech - Medium]() Topics: [AWS CloudTrail](), [Amazon Web Services](), [VPC Flow Logs](), [Amazon S3](), [AWS CloudFormation](), [DynamoDB](), [JSON]() Tags: [amazon-s3](), [athena](), [aws](), [aws-cloudtrail](), [cloud](), [cloudformation](), [cloudtrail](), [dynamodb](), [events](), [json](), [vpc-flow-logs]() ### AI overview A tutorial explains how to automate daily AWS Athena partition creation for organization-level CloudTrail and VPC Flow Logs. It describes using Amazon S3, AWS Glue Data Catalog, CloudFormation, SAM, Lambda, DynamoDB, and EventBridge to improve query efficiency and reduce scanned data and cost. ### Source excerpt This article's goal is to explain how to query efficiently, and at low cost with AWS Athena, AWS CloudTrail logs, or VPC Flow logs by automating the creation of Athena partitions daily. AWS CloudTrail AWS CloudTrail is a service that records all API Calls and Events for AWS Accounts, including details on calls made to your AWS Services and the Console as well. Activated at the Organization level, CloudTrail logs help you in several cases: Simplified Compliance Summarizing Accesses Security Analysis and Troubleshooting Monitoring Users and Resources Activities Governance and Investigation CloudTrail Logs are delivered in an S3 Bucket in JSON format through many small files that make these difficult to operate and request. VPC Flow Logs VPC Flow Logs is a feature that allows you to capture traffic information going to and from your network interfaces in your VPC. It helps you to: Analyze and troubleshoot network issues Determine the direction of your traffic Monitor the traffic Like CloudTrail Logs, Flow Logs are published in an S3 Bucket for all accounts in the Organization. AWS Athena AWS Athena is a query service that permits you to analyze data directly in an Amazon S3. You can create tables in Athena which use AWS Glue Data Catalog and are based on an S3 location. To query efficiently and with less scanned data and optimize the cost, we need to create some partitions. To know more about Tables, Databases, and Catalog in Athena. Automate Partitions Creation In our case, we are using CloudTrail Logs and VPC Flow Logs to detail the solution and the source code. All is done in CloudFormation and using SAM to deploy the Lambda. Global Overview We have several parts to automate the creation of our partitions. A common part containing: The Lambda is used to create partitions concerning different log types A DynamoDB table used to store partition names A specific part for each log type contains: The Glue Table with the proper structure An EventBridge Rule to trigger the ## Seven Practices to Prepare a Startup for SOC 2 DevFeed: [Seven Practices to Prepare a Startup for SOC 2]() Original publisher: [Read original article]() Published: 2020-03-12T17:49:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [soc2](), [Security](), [Terraform](), [CI/CD](), [Google Cloud Identity](), [okta](), [Logging](), [Provisioning](), [AWS CloudTrail](), [protected branches](), [GitHub]() Tags: [aws](), [ci-cd](), [cloudtrail](), [deployment](), [github](), [logging](), [okta](), [patches](), [protected-branches](), [security](), [soc2](), [terraform]() ### AI overview The article recommends seven practices for startups that expect large-company clients to require a SOC 2 report: centralized identity with 2FA, pull-request controls and CI/CD, centralized logging, infrastructure provisioning with Terraform or a similar tool, AWS CloudTrail and AssumeRole, device management with encryption and current patches, and software vendor risk tracking. It also recommends documenting basic policies. ### Source excerpt So, you plan to sell your startup's product to big companies one day. Congratu-dolences! Really, that's probably the only reason you should care about this article. If that's not you, go forth and live your life! We'll ask no more of your time. For the rest of you: Industry people talk about SOC2 a lot, and it's taken on a quasi-mystical status, not least because it's the product of the quasi-mystical accounting industry. But what it all boils down to is: eventually you'll run into big-company clients demanding a SOC2 report to close a sale. You know this and worry about it. ## Using AWS CloudTrail to enhance your serverless application security DevFeed: [Using AWS CloudTrail to enhance your serverless application security]() Original publisher: [Read original article]() Author: Ory Segal Published: 2018-10-11T00:00:00Z Content type: tutorial Language: en Sources: [Serverless Blog]() Topics: [AWS CloudTrail](), [Serverless](), [Application Security](), [Security]() Tags: [application-security](), [aws](), [aws-cloudtrail](), [aws-lambda](), [cloud-computing](), [cloudtrail](), [engineering](), [faas](), [function-as-a-service](), [how-to](), [infrastructure-as-code](), [learn](), [serverless](), [serverless-architecture](), [serverless-framework]() ### AI overview A tutorial on using AWS CloudTrail to improve the security posture of serverless applications. ### Source excerpt Learn how to harness AWS CloudTrail to enhance your serverless application security posture. ## How to monitor AWS account activity with Cloudtrail, Cloudwatch Events and Serverless DevFeed: [How to monitor AWS account activity with Cloudtrail, Cloudwatch Events and Serverless]() Original publisher: [Read original article]() Author: Alex DeBrie Published: 2018-01-15T00:00:00Z Content type: tutorial Language: en Sources: [Serverless Blog]() Topics: [Amazon Web Services](), [AWS CloudTrail](), [Serverless](), [Automation](), [monitor]() Tags: [automation](), [aws](), [aws-lambda](), [cloud-computing](), [cloudtrail](), [engineering](), [faas](), [function-as-a-service](), [how-to](), [infrastructure-as-code](), [monitor](), [serverless](), [serverless-architecture](), [serverless-framework]() ### AI overview A tutorial on monitoring AWS account activity with CloudTrail, CloudWatch Events, and Serverless, including automation that reacts to events from AWS services. ### Source excerpt Level up your AWS automation by reacting to events from AWS services.