6 Ways to Use CloudTrail to Improve AWS Security

October 02, 2018

These days it's pretty commonplace knowledge that when it comes to clouds – being as dynamic and fast paced as they are – organizations need as much insight as they can get in order to recognize where any looming threats might be, what they are, and the necessary means to get some context about how these threats could potentially (read: inevitably) cause headaches.

As we know, Amazon Web Services (AWS) S3 breaches tend to be caused by a bucket being inadvertently exposed. Generally, the fault lies in being unaware of how buckets are being used and the corresponding configurations (and changes to those configurations). What is critical to know is whether or not the configurations are adequate to maintain the type of security necessary for the data being transacted in and through that bucket.

When it comes to their S3 buckets, the most important thing for cloud security managers is to have a purpose for their S3 buckets and know how they're being used. One of the best ways of doing this is by using relevant data provided by CloudTrail logs, and factoring it into the continuous monitoring of your cloud activities.

CloudTrail identifies and tracks API calls being made on behalf of your AWS accounts. Logs encode the specifics of the calls being made, including important data like time of call, who made the call (even if it was done outside of your organization), the IP of where the call originated, success of the call, errors, and pretty much all other important information.

There's no question that CloudTrail is an important element of AWS's inherent cloud security tools. However, it can also be limiting unless it's included as part of a comprehensive, end-to-end approach that identifies and evaluates everything happening in your cloud.

Unfortunately, a surprising number of organizations we talk with don't even turn on CloudTrail, so they actually miss the several opportunities that it can provide.

Here are six, key best practices that will help your organization identify issues within your AWS accounts, and will optimize the benefits of using a host-based approach:

Turn on CloudTrail across your entire AWS environment: Once turned on, you'll have CloudTrail logging for all your AWS activities, irrespective of region.
Require MFA for S3 bucket access: Hackers have this nasty habit of deleting CloudTrail logs in order to cover their tracks. With MFA turned on for S3 bucket access, the hacker will have an additional, and complicated, hurdle to cross. MFA is simple to implement and will ultimately save you major headaches later on.
Enable S3 bucket logging: CloudTrail uses S3 buckets to capture and store AWS events. Enabling that logging for buckets ensures you can identify and track any and all access and usage. Seeing the unauthorized access and where they're coming from will provide a great advantage in doing forensic analysis.
Use least privilege for CloudTrail S3 buckets: This is all about restricting access to logs. Most people in your organization won't need to see these logs anyway, so keeping a narrow list of admins will reduce the potential for misuse, phishing, dead account clean up, and other hacker targets that can result from widespread access.
Encrypt logs at rest: This is a great way to maintain oversight over logs. Because users will have to decrypt CloudTrail files after they're encrypted, it creates an additional, complex step in the process, and it demands that users who decrypt files must have permission both to decrypt and encrypt.
Provision access with IAM policies: When you map access to groups or roles instead of specific people, you decrease the potential of unintentional access being granted. It also reduces the logistics of permission management and allows you better control over access points.

Managing security in AWS is not a set-it-and-forget-it type of proposition, but with proper management of CloudTrail, along with a host-based continuous monitoring solution, you'll have the insight needed to be effective at combating threats. With more knowns, less unknowns, and knowing what you know and don't know, you'll be prepared to maintain your cloud environment's security posture and keep your environment safe.

About the author: Sanjay Kalra is co-founder and CPO at Lacework, leading the company's product strategy, drawing on more than 20 years of success and innovation in the cloud, networking, analytics, and security industries.