Deleting a compromised AWS Access Key isn't sufficient(blog.redlock.io)

2 pointsby gauravphoenixvor 9 Jahren2 comments

blog.redlock.io

Deleting a compromised AWS Access Key isn't sufficient

https://blog.redlock.io/aws-access-key-security-best-practices

2 comments

for0onevor 9 Jahren

"(The attacker) proceeds to create temporary security credentials using the AWS (STS) Security Token Service. These credentials are valid for a period of time ranging from 15 mins to 36 hours based on the parameters used when requesting the tokens. In this example, the attacker uses 36 hours."

I don't use AWS often. Does AWS provide a way to receive notifications when AWS STS commands are run? Or do some admins setup syslogging to capture these events?

gauravphoenixvor 9 Jahren

You can review the logs in the CloudTrail https://aws.amazon.com/cloudtrail/