Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Detect when an AWS secret is retrieved from an AWS CloudShell environment.
Strategy
Monitor CloudTrail and detect when an AWS secret is retrieved from an AWS CloudShell environment. The threat group LUCR-3 uses AWS CloudShell in the AWS management console to carry out activities that require direct interaction with the AWS API, such as the retrieval of secrets.
Triage and response
- Determine if
{{@userIdentity.arn}} should have carried out this operation. - If the API calls were not made by the user:
- Rotate user credentials.
- Rotate the secrets retrieved by the identity, if feasible.
- Determine what other API calls were made by the user.
- Begin your organization’s incident response process and investigate.
