8 ms·

So if they didn't create a new user account and IAM account what would you see? If they just used the remote shell and the installed aws cli e.g. `aws s3 ls` wo

by ff7c11 5y ago

So if they didn't create a new user account and IAM account what would you see? If they just used the remote shell and the installed aws cli e.g. `aws s3 ls` would you be able to detect it? This article is an ad.

jffry 5y ago
You'd still see the activity of that machine in AWS CloudTrail logs. From [1]: "CloudTrail records two types of events: Management events capturing control plane actions on resources such as creating or deleting Amazon Simple Storage Service (Amazon S3) buckets, and data events capturing data plane actions within a resource, such as reading or writing an Amazon S3 object. [1] https://aws.amazon.com/cloudtrail/features/ https://aws.amazon.com/cloudtrail/features/