🧰 AWS CloudTrail

The items that name it 23

• Datadog pathrunner: AWS IAM privilege escalation framework
  toolas affected products2026-10-20It is written here as AWS CloudTrail (audit log events generated by pathrunner activity).

  audit log events generated by pathrunner activity

• DFIR Radar (@DFIR_Radar) on X
  threadas affected products2026-10-19
• Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM
  articleas classification.technologies2026-10-12
• Improving SPIRE security and resiliency with AWS managed services
  articleas tools2026-10-06

  Logging and auditing of KMS signing requests and Secrets Manager secret access

• Identity-aware AI data agents with AWS Lake Formation and Trusted Identity Propagation
  articleas tools2026-10-06

  Audit logging of AssumeRole events, including onBehalfOf entries naming the actual human user

• ICYMI: August 2026 @AWS Security
  articleas tools2026-09-23

  log source for cross-service signal correlation and audit pipelines

• Transforming Bedrock Guardrails events into OCSF with CloudWatch
  writeupas tools2026-09-21

  Vended security data source providing identity/audit events correlated with guardrail findings

• Run open weight models on Amazon Bedrock in AWS European Sovereign Cloud
  articleas tools2026-09-17

  Records every call to the inference endpoint for auditing, giving security and compliance teams a record of who invoked inference and when.

• Exploring the new AWS Sign Up experience
  writeupas tools2026-09-17

  Event logging service; not configured in sandbox but Event History available for 90 days via limited interface

• Architecting a secure landing zone in the AWS European Sovereign Cloud
  articleas tools2026-09-16

  Audit logging service deployed org-wide; global service events logged within the EUSC partition

• AWS STS simplifies session token size limits and adds session token size monitoring
  articleas tools2026-09-15

  Records SessionTokenUtilization and SessionTokenSize fields in STS session-vending events for auditing/monitoring

• Operationalizing least privilege: Automate IAM remediation through your CI/CD pipeline
  writeupas tools2026-09-15

  Used to determine role origin/attribution by inspecting CreateRole events (service principal, user agent, IAM user) to classify roles as IaC-managed, manually created, or unknown

• Machine speed, hold the AI: hand-rolled marimo CVE-2026-39987 exploit
  writeupas tools2026-09-11

  Used by the operator to validate harvested AWS credentials, and cited as a detection source for identifying region-fallback GetSecretValue discovery patterns.

• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas tools2026-09-08

  Logging used to alert on all root activity and as a hunt data source.

• Incident response guide for AWS CloudTrail investigations – Part 2 | Amazon Web Services
  writeupas tools2026-09-03

  Logs API calls/events used to investigate and reconstruct the multi-stage attack (userIdentity, readOnly, awsRegion, invokedBy fields, etc.)

• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeupas affected products2026-09-03
• Managing identity source transition for AWS IAM Identity Center
  writeupas affected products2026-09-02
• Password spraying campaign targets AWS root user accounts across 150+ organizations
  articleas tools2026-08-31

  Records ConsoleLogin events; queried to check whether the campaign affected an organization and to alert on root activity

• Orca Security: ITDR for the Cloud
  articleas tools2026-07-03

  Source of audit-log telemetry for cloud ITDR behavioral baselining and detection

• AWS Well-Architected: Software Supply Chain Security
  articleas tools2026-06-04

  Audit trails for credential access and API activity; used to detect compromised credentials and forensic analysis

• State of Post Quantum Cryptography | Wiz Blog
  articleas tools2026-05-28

  Provides logs with information about TLS connection requests made to AWS APIs, used to measure TLS 1.3 and PQC key exchange usage

• llm-trails: What LLMs reach for inside a breached AWS account
  repoas affected products
• AWS EKS Forensics: Data Sources and Investigation Tooling
  articleas tools

  Records AWS API activity from node and pod IAM identities, used to detect stolen credential replay outside the cluster

In every workspace you can read 25