JUSTIN SAMUEL

Hi, I’m Justin – welcome to my space on the Internet. I’m journalling about what I’m learning in the world of cloud security and the wider cybersecurity field.

  • What is AWS CloudTrail?

    An introduction to CloudTrail.

    • CloudTrail provides governance, compliance, and audit for an AWS account.
    • Enabled by default.
    • You can view history of API calls / history of events in your AWS account.
    • Events are stored for 90 days (for long-term storage, use S3 and Athena).
    • Logs from CloudTrail can be stored in CloudWatch Logs or S3.
    • Trails can be applied to All Regions or a single Region.

    Management Events:

    • Actions involving creation, modification, or deletion of resources. Also includes user sign-ins.
    • Separates Read Events and Write Events.
    • Logged by default.

    Data Events:

    • Object / resource-level actions (ex. GetObject / PutObject in S3).
    • Not logged by default.
    • If you require visibility in who accessed a specific S3 object, you’d need to enable data events.

    CloudTrail Insights:

    • Detects unusual API activity (ex. sudden burst of IAM CreateUser API calls, spike in failed API calls, etc).
    • Analyses account baseline and automatically flags anomalous events.
    • Optional. Not enabled by default.

    CloudTrail Lake:

    • A managed data lake allowing you aggregate, store and query events.
    • Includes:
      • CloudTrail Events
      • CloudTrail Insights Events
      • Config Configuration Items
      • AWS Audit Manager
      • 3rd Party Events
    • Immutable storage with max. 10 year retention period.
    • Store events from AWS Organisations.
    • You can also build interactive dashboards with the data from the lake.

    More reading:

    —

  • What is Amazon Athena?

    An introduction to Amazon Athena.

    • Serverless query service analysing data stored in S3 using SQL.
    • Supports CSV, JSON, ORC, Avro, Parquet.
    • $5 per TB of data scanned (10MB minimum per query).
    • Commonly used with QuickSight for reporting / dashboards.
    • Using columnar data can help save on costs.
      • Use Apache Parquet or ORC.
      • Improves performance and lowers cost.
      • Glue to convert data to Parquet or ORC.
    • Compressing data using bzip2, gzip, or lz4 can reduce the amount of data that needs to be retrieved.
    • Partitioning data (ex. by year=2026/month=08/) lets Athena skip irrelevant S3 objects – biggest cost/performance lever of all.
    • Uses AWS Glue Data Catalog to store table/schema definitions – Glue Crawlers can auto-discover schema.
    • Federated Query lets Athena query data outside S3 (ex. DynamoDB, RDS, CloudWatch Logs) using Lambda-based connectors.
    • Permissions live at the S3/Glue Catalog layer, not inside Athena itself — restricting athena:* alone doesn’t block direct S3 access.
    • Workgroups isolate teams, enforce result encryption, and cap data scanned per query/day.
    • Commonly paired with CloudTrail/VPC Flow Logs for SQL-based log investigation.

    More reading:

    —

  • Introducing Amazon EventBridge.

    An introduction to Amazon EventBridge

    • Serverless event bus that decouples event producers from event consumers (pub/sub model).
    • Automates actions in response to events happening across your AWS environment:
      • Schedule cron-style jobs (ex. trigger a Lambda function every hour).
      • React to state changes (ex. send an SNS email notification when a specific IAM user signs in, via CloudTrail).
    • Events can be aggregated across AWS accounts, regions, and your AWS Organization — using event buses and resource-based policies for cross-account delivery.
    • Successor to CloudWatch Events, with broader routing (SaaS partners, custom apps) via rules and event patterns matched against a bus.

    More reading:

    —

  • What is CloudWatch?

    An introduction to CloudWatch.

    CloudWatch Agent:

    • CloudWatch uses an agent called the Unified CloudWatch Agent that is installed on an EC2 instance or on-prem server.
    • Collects system-level metrics such as RAM, processes, used disk space, etc.
    • Collects logs, which are sent to CloudWatch Logs.
    • Can be centrally managed using SSM Parameter Store.
    • procstat plugin collects metrics and monitors system utilisation of individual processes.
      • Amount of time process uses CPU (procstat_cpu_usage)
      • Amount of memory process used (procstat_memory_rss)

    CloudWatch Logs:

    • Logs are encrypted by default. KMS-based encryption is also available using your own keys.
    • You must first define:
      • Log groups (arbitrary name, typically for an application of interest)
      • Log stream (refers to log files or instances of logs)
    • You can configure log expiration policies (never expire, 1 day -> 10 years, etc.)
    • You can send these logs to the likes of:
      • Amazon S3
      • Kinesis (Data Streams, Firehose)
      • Lambda
      • OpenSearch
    • Sources of logs can come from:
      • SDK
      • CloudWatch Unified Agent
      • Elastic Beanstalk
      • Lambda
      • ECS
      • VPC Flow Logs
      • API Gateway
      • CloudTrail
      • Route 53
    • CloudWatch Logs Insights can be used to search for and analyse log data (not real-time, only historical).
    • CloudWatch Logs Subscriptions can be used to retrieve real-time log events.
      • Logs can be sent to Kinesis, S3, Lambda.
      • Cross-Account Subscription can also be used to sent log events to resources in different AWS accounts.

    CloudWatch Alarms:

    • Alarms trigger notifications for any metric.
    • Metrics include:
      • %
      • Max
      • Min
      • …and more
    • Alarm states include:
      • OK
      • INSUFFICIENT_DATA
      • ALARM
    • Period:
      • Length of time (sec) to evaluate metric
      • Custom metrics (every 10 sec, 30 sec, 60 sec, etc.)
    • Composite alarms can be used to monitor the state of multiple alarms using AND and OR conditions.

    CloudWatch Contributor Insights:

    • Analyses logs to create a time series showing contributor data and top hitters.
    • For example: identify heaviest network users, find URLs generating most errors.

    More reading:

    —

  • A Guide to Amazon Inspector.

    • Allows you to run automated security assessments.
    • For EC2 instances, it uses an SSM (AWS System Manager) agent.
      • Detects unintended network accessibility and OS known vulnerabilities.
    • Assesses Container Images pushed to Amazon ECR.
    • Identifies software vulns in code and package dependencies in Lambda functions.
    • Provides risk score of vulnerability.
    • Integration with AWS Security Hub.
    • Findings can be sent to EventBridge.
    • EC2, Container Images, Lambda Functions only.

    More reading:

    —

  • What is Amazon Detective?

    • Analyses, investigates, and identifies root cause of security findings Machine Learning, statistics analysis, and graphs theory.
    • Security findings data comes from GuardDuty, Macie, and Security Hub.
    • Collects and processes events from data streams (CloudTrail, VPC Flow Logs, GuardDuty) to create unified view.
      • EKS Audit Logs, Security Hub are also optional data streams
    • Up to 1 year of aggregated data analysis.
    • You can also investigate IAM users and roles to see if they were used in a security event.

    More reading:

    —

  • An Introduction to AWS Security Hub.

    • Security Hub is a central security tool with an integrated dashboard used to manage several AWS accounts and automate security checks.
    • Aggregates alerts from various AWS services including:
      • Config
      • GuardDuty
      • Macie
      • Inspector
      • IAM Access Manager
    • AWS Config Service must be enabled for Security Hub to work.
    • EventBridge can be used to automate responses to alerts in the Security Hub.
    • Security Hub generates findings and can check against security standards (ex. CIS AWS Foundations, PCI DSS).
    • Findings are automatically deleted after 90 days.
    • Insights are a collection of related findings that identify a security area requiring attention.
    • Cross-Region Aggregation – aggregate findings from multiple regions.

    More reading:

    —

  • What is Amazon GuardDuty?

    • Intelligent Threat Detection service.
    • Detects malicious activity in your AWS account.
      • Examples include: cryptomining, data exfil, compromised AWS credentials or account
    • Uses AI, machine learning, anomaly detection, malicious file discovery.
    • One-click to enable.
    • Analyses data sources:
      • Examples:
        • CloudTrail Management Events – anomalous API calls, unauthorised deployments
        • VPC Flow Logs – anomalous traffic, strange IP addresses
        • Route 53 DNS Query Logs – compromised EC2 instances sending encoded data within DNS queries
    • Includes Extended Threat Protection.
      • Detects multi-stage attacks spanning multiple data sources and EC2 instances
    • GuardDuty Protection Plans:
      • Malware Protection for EC2 – scans EBS volumes to detect malware
      • EKS Protection – monitors Kubernetes audit logs from EKS clusters for suspicious activities
      • Runtime Monitoring – monitors OS-level events on EC2, ECS, EKS for threats
      • Lambda Protection – analyses Lambda network activity logs using VPC Flow Logs to detect threats such as cryptomining or communications with known malicious servers
      • S3 Protection – identifies security risks in S3 buckets such as data exfil
      • Malware Protection for S3 – identifies malware in S3 buckets
      • Malware Protection for AWS Backup – scans Backup resources (ex. EBS Snapshots, AMIs) for malware
      • RDS Protection – analyses RDS and Aurora login activity for threats
    • GuardDuty Findings
      • Findings are generated by GuardDuty from data streams (ex. CloudTrail logs, VPC Flow Logs). Findings severity ranges from 0.1 -> 8+.
      • Example:
        • ThreatPurpose:ResourceTypeAffected/ThreatFamilyName.DetectionMechanism!Artifact
        • ThreatPurpose – purpose of threat (ex. cryptomining, backdoor)
        • ResourceTypeAffected – which AWS resource is targeted (ex. EC2, S3)
        • ThreatFamilyName – describes potential malicious activity (ex. NetworkPortUnusual)
        • DetectionMechanism – method GuardDuty used to detect finding (ex. TCP, UDP)
        • Artifact – describes resources used in malicious activity (ex. DNS)
      • You can use EventBridge to automate responses to security findings. SNS (Simple Notification Service) to send emails or Slack alerts.

    More reading:

    —

    ,

  • SCS-C03 #6: CloudFormation.

    Note: This is the sixth post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

    • AWS CloudFormation:
      • Using YAML or JSON, you can create AWS resources in an easily-repeatable, automated manner
      • You decide what to create, and CloudFormation decides how to create it
      • YAML / JSON templates are used to create Stacks, which provision resources according to your instructions
        • If a Stack template is changed: the resources are changed and/or updated
        • If a Stack is deleted: the resources are deleted
      • CloudFormation creates real-world Physical Resources based on the Logical Resources you define in your template – the Logical ID is how you reference that resource elsewhere in the template, and CloudFormation maps it to the actual Physical Resource once created.
      • Parameters:
        • Template parameters1: allows the user to insert values into the template at runtime to change options applied to resources
        • Pseudo parameters2: created and populated by AWS (ex. AWS::Region, AWS::StackName, etc) – although it’s much less flexible and limited

    CloudFormation is definitely a hefty subject for me – I may come back and update this post in the near-future.

    Thanks for reading!

    -J

    More reading:

    1. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html ↩︎
    2. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html ↩︎

    —

  • SCS-C03 #5: AWS Trusted Advisor.

    Note: This is the fifth post in my AWS SCS-C03 series. You can see the rest of the posts in the series using the link above.

    • AWS Trusted Advisor
      • Trusted Advisor inspects your account across different categories: Cost Optimization,
        Performance, Security, Fault Tolerance, Service Limits, and Operational Excellence.
      • Access to checks depends on your AWS Support Plan:
        • Basic / Developer Support: limited to ~56 core checks
        • Business Support and above: full access to about 482 checks across all categories1
        • Trusted Advisor Priority requires Enterprise Support
      • Trusted Advisor integrates with EventBridge, allowing you to trigger
        notifications (SNS) or remediation actions (Lambda) when a check’s status changes.

    Thanks for reading!

    -J

    More reading:

    1. Correct as of July 28th, 2026 – this is subject to change ↩︎

    —