Which AWS CloudTrail events should you alert on? This list is grouped by event source, and every event on it can indicate a security event: someone disabling logging, creating credentials, opening up access, or exfiltrating data. It started from 4n6ir's Expediate project (no longer online), and we've since corrected and extended it.

Not all of these will make sense for your environment, and some will cause alert fatigue depending on your use case. Use this as a starting point and reference, but think through the implementation. Consider also using existing monitoring and alerting tools like the AWS Security Survival Kit instead of reinventing the wheel. For how to wire up alerts with EventBridge and SNS, see AWS Security Monitoring, Logging, and Alerting.

Two things to know before you build rules from this list:

  • Some services log versioned event names. Lambda, for example, logs CreateFunction as CreateFunction20150331, so use prefix matching in EventBridge ({"prefix": "CreateFunction"}) instead of exact names.
  • Data events, like S3 RestoreObject, only show up if you've enabled data events on your trail.

Tip: Some of these events fire constantly during normal use. For example, CloudShell's GetFileDownloadUrls: here's how to filter it out of an EventBridge rule.

cloudshell.amazonaws.com

  • CreateEnvironment
  • CreateSession
  • DeleteEnvironment
  • GetEnvironmentStatus
  • GetFileDownloadUrls
  • GetFileUploadUrls
  • PutCredentials
  • StartEnvironment
  • StopEnvironment

cloudtrail.amazonaws.com

  • DeleteEventDataStore
  • DeleteTrail
  • PutEventSelectors
  • StopEventDataStoreIngestion
  • StopLogging
  • UpdateEventDataStore
  • UpdateTrail

config.amazonaws.com

  • DeleteConfigurationRecorder
  • DeleteDeliveryChannel
  • StopConfigurationRecorder

connect.amazonaws.com

  • CreateInstance

ec2.amazonaws.com

  • CreateDefaultVpc
  • CreateImage
  • CreateInstanceExportTask
  • CreateKeyPair
  • CreateVpc
  • DeleteFlowLogs
  • DeleteVpc
  • DescribeInstanceAttribute
  • DisableEbsEncryptionByDefault
  • DisableImageBlockPublicAccess
  • DisableSerialConsoleAccess
  • DisableSnapshotBlockPublicAccess
  • EnableEbsEncryptionByDefault
  • EnableImageBlockPublicAccess
  • EnableSerialConsoleAccess
  • EnableSnapshotBlockPublicAccess
  • GetPasswordData
  • ModifyInstanceAttribute
  • ModifySnapshotAttribute
  • SharedSnapshotCopyInitiated
  • SharedSnapshotVolumeCreated

ecr.amazonaws.com

  • CreateRepository
  • GetAuthorizationToken

ecs.amazonaws.com

  • RegisterTaskDefinition
  • RunTask

eks.amazonaws.com

  • CreateCluster
  • DeleteCluster

elasticache.amazonaws.com

  • ModifyCacheCluster
  • ModifyReplicationGroup

elasticfilesystem.amazonaws.com

  • DeleteFileSystem
  • DeleteMountTarget

glue.amazonaws.com

  • CreateSession
  • CreateDevEndpoint (legacy)
  • DeleteDevEndpoint
  • UpdateDevEndpoint

guardduty.amazonaws.com

  • CreateFilter
  • CreateIPSet
  • CreateThreatIntelSet
  • DeleteDetector
  • DeleteMembers
  • DisassociateFromAdministratorAccount
  • DisassociateMembers
  • UpdateDetector
  • UpdateFilter
  • UpdateThreatIntelSet

iam.amazonaws.com

  • AddUserToGroup
  • AttachGroupPolicy
  • AttachUserPolicy
  • ChangePassword
  • CreateAccessKey
  • CreateLoginProfile
  • CreateUser
  • CreateVirtualMFADevice
  • DeactivateMFADevice
  • DeleteAccessKey
  • DeleteUser
  • DeleteUserPolicy
  • DeleteVirtualMFADevice
  • DetachGroupPolicy
  • DetachUserPolicy
  • EnableMFADevice
  • PutUserPolicy
  • ResyncMFADevice
  • UpdateAccessKey
  • UpdateGroup
  • UpdateLoginProfile
  • UpdateSAMLProvider
  • UpdateUser

kms.amazonaws.com

  • DisableKey
  • PutKeyPolicy
  • ScheduleKeyDeletion

lambda.amazonaws.com

  • AddLayerVersionPermission
  • AddPermission (logged as AddPermission20150331v2)
  • CreateFunction (logged as CreateFunction20150331)
  • GetLayerVersionPolicy
  • PublishLayerVersion (logged as PublishLayerVersion20181031)
  • UpdateFunctionCode (logged as UpdateFunctionCode20150331v2)
  • UpdateFunctionConfiguration (logged as UpdateFunctionConfiguration20150331v2)

macie2.amazonaws.com

  • DisableMacie

organizations.amazonaws.com

  • LeaveOrganization

rds.amazonaws.com

  • ModifyDBInstance
  • RestoreDBInstanceFromDBSnapshot

rolesanywhere.amazonaws.com

  • CreateProfile
  • CreateTrustAnchor

route53domains.amazonaws.com

  • DisableDomainTransferLock
  • TransferDomainToAnotherAwsAccount

s3.amazonaws.com

  • DeleteBucketEncryption
  • DeleteBucketPolicy
  • PutBucketEncryption
  • PutBucketLifecycle
  • PutBucketLogging
  • PutBucketPolicy
  • PutBucketPublicAccessBlock
  • PutBucketReplication
  • PutBucketWebsite
  • RestoreObject (data event)

securityhub.amazonaws.com

  • BatchUpdateFindings
  • DeleteInsight
  • DisableSecurityHub
  • UpdateFindings
  • UpdateInsight

sso.amazonaws.com

  • AttachCustomerManagedPolicyReferenceToPermissionSet
  • AttachManagedPolicyToPermissionSet
  • CreateAccountAssignment
  • CreateInstanceAccessControlAttributeConfiguration
  • CreatePermissionSet
  • DeleteAccountAssignment
  • DeleteInlinePolicyFromPermissionSet
  • DeleteInstanceAccessControlAttributeConfiguration
  • DeletePermissionsBoundaryFromPermissionSet
  • DeletePermissionSet
  • DetachCustomerManagedPolicyReferenceFromPermissionSet
  • DetachManagedPolicyFromPermissionSet
  • ProvisionPermissionSet
  • PutInlinePolicyToPermissionSet
  • PutPermissionsBoundaryToPermissionSet
  • UpdateInstanceAccessControlAttributeConfiguration
  • UpdatePermissionSet

sts.amazonaws.com

  • GetFederationToken
  • GetSessionToken

Sources