Glossary
Plain-language definitions of the AWS logging and incident-response terms used across the blog.
- MITRE ATT&CK
- A public knowledge base of adversary tactics and techniques; its cloud (IaaS) matrix gives shared ids such as T1078.004 or T1562.008 for AWS attack behaviour.
- Service control policy (SCP)
- An AWS Organizations policy that caps the maximum permissions of member accounts — used in incidents to deny unused regions or protect logging.
- STS AssumeRole
- The AWS STS operations that exchange a trust relationship for temporary role credentials — AssumeRole, AssumeRoleWithSAML and AssumeRoleWithWebIdentity.
- GetCallerIdentity
- The STS API that returns the account, ARN and user ID behind a set of credentials. It needs no permissions, so it is the first call made with a stolen key.
- AWS access key
- An access key ID and secret used to sign AWS API requests. AKIA prefixes are long-term IAM user keys; ASIA prefixes are temporary STS credentials.
- IAM credential report
- A CSV listing every IAM user and the root user with password, MFA and access-key status and last-used dates — a snapshot of who can sign in to an AWS account.
- GuardDuty
- AWS's managed threat-detection service: it analyses CloudTrail, VPC Flow Logs, DNS logs and more, and raises typed findings such as PenTest:IAMUser/KaliLinux.
- S3 server access logs
- Per-request text logs of an S3 bucket — requester, operation, object key, status and bytes sent — delivered best effort to a target bucket or CloudWatch Logs.
- VPC Flow Logs
- AWS network flow records per network interface: addresses, ports, protocol, bytes, packets and accept/reject — metadata only, with no payload.
- CloudTrail data events
- High-volume, resource-level CloudTrail events such as S3 GetObject or Lambda Invoke — not logged by default, and the only CloudTrail proof of which S3 objects were read.
- CloudTrail event history
- The built-in, per-region record of the last 90 days of CloudTrail management events, available in every AWS account without any trail configured.
- CloudTrail
- The AWS service that records API calls and console sign-ins in an account as JSON events — the primary evidence source in almost every AWS investigation.