AWS telemetry sources and ingestion priority
Prioritise by attack-path coverage. Tier 1 (ingest on day 1): CloudTrail management events (API calls), IAM Access Analyzer findings, GuardDuty findings. These three sources cover the majority of initial access and privilege escalation paths. Tier 2: S3 data events on sensitive buckets, CloudTrail data events for Lambda, ECS task logs. Tier 3: VPC Flow Logs for specific segments, Config change events.
CloudTrail management events cost nothing extra if you already have a trail configured — the cost is in querying and storing them. Enable all regions from day one; attackers frequently pivot to regions with no trail coverage. Validate with a test API call to a seldom-used region.
GuardDuty findings are pre-classified but should not be treated as verdicts. Ingest them as enrichment signals in ManySignal's entity graph rather than as standalone alerts — they are most useful when combined with CloudTrail context to answer 'what did that flagged identity do before and after the GuardDuty finding?'
- CloudTrail management events: all regions, all services
- S3 trail bucket protected with MFA delete and versioning
- GuardDuty enabled in all regions including us-east-1
- IAM Access Analyzer enabled for all accounts in the org
- ManySignal CloudTrail connector validated with test event
IAM and identity detection
AWS IAM is the primary attack surface in most cloud compromises. Key detections: new IAM user created (T1136.003), new access key created for root (T1078.004), policy change broadening permissions (T1098.001), AssumeRole to a role the identity has never assumed (behavioural), and console login without MFA for a sensitive role.
The entity graph models IAM identities as first-class entities with their own baselines: which roles they assume, which services they call, which regions they operate in. An AssumeRole to a new role in a new region is behavioural — it will not appear in a static rule but will appear in the graph's anomaly score.
# detections/aws/new_access_key_root.yaml
key: aws.new_access_key_root
domain: cloud_iam
severity: critical
type: streaming
where:
class_uid: 3005
source: aws_cloudtrail
operation: CreateAccessKey
actor_user: root
outcome: success
attck:
tactic: TA0006
techniques: [T1078.004]
stage: activeS3 and data exfiltration detection
S3 data exfiltration patterns: unusually large GetObject volume from a single identity (volumetric anomaly against 90-day baseline), GetObject on a bucket an identity has never accessed (first-access behavioural), public bucket policy applied (T1567.002), and cross-account bucket replication configured.
Enable S3 data events selectively: buckets tagged data-classification=sensitive or data-classification=restricted only. Enabling data events for all buckets in a large org will create ingestion costs that exceed the value of the additional coverage.
Multi-account and Org-level monitoring
In AWS Organizations environments, centralise CloudTrail to a dedicated security account with a cross-account S3 bucket that member accounts cannot write to or delete from. ManySignal's multi-account connector uses a cross-account IAM role in each member account — one role per account, least-privilege, read-only.
Monitor SCP changes (Service Control Policy) at the Org level — SCPs are the guardrail for the entire estate. A SCP change that removes a deny boundary is a critical event equivalent to an IAM policy change broadening root permissions.
Key detections to ship in week one
Root account console login, new IAM user creation outside IaC, access key creation for human identities, AssumeRole to a cross-account role by a service identity, public S3 bucket policy applied, GuardDuty finding of severity High or Critical, and CloudTrail logging disabled in any region. These seven cover the highest-probability initial-access and persistence paths in AWS.
Each detection should have a corresponding response playbook that the respond agent can execute: root login triggers MFA prompt + alert to SecOps lead; public bucket policy triggers policy reversal pending human review.
Key takeaways
- Tier 1 on day 1: CloudTrail management events, GuardDuty, IAM Access Analyzer — all regions.
- GuardDuty findings are enrichment signals in the entity graph, not standalone alerts.
- IAM is the primary attack surface; behavioural detections on role assumption add coverage beyond static rules.
- Enable S3 data events selectively — sensitive-tagged buckets only.
- Centralise CloudTrail to a security account in AWS Orgs environments.
- Seven must-have detections for week one cover the highest-probability AWS attack paths.