Skip to content

Instantly share code, notes, and snippets.

@gene1wood

gene1wood/mozilla_cloudtrail_investigation_method.txt

Created March 30, 2016 18:11
Show Gist options
  • Save gene1wood/fc3b7ea9fc3f5c8786dd97d4b60b4baa to your computer and use it in GitHub Desktop.
Save gene1wood/fc3b7ea9fc3f5c8786dd97d4b60b4baa to your computer and use it in GitHub Desktop.
Download ZIP
Notes on how to investigate incidents in CloudTrail logs
Raw
mozilla_cloudtrail_investigation_method.txt
# First launch a centos7 ec2 instance in infosec-prod with an IAM role granting lots of stuff
yum install epel-release
yum install python-pip
pip install awscli
# create aws_assume_role https://gist.github.com/gene1wood/34b02fa3091e184e1997
. aws_assume_role arn:aws:iam::088944123687:role/CloudTrail-Global-Log-Consumers
account_id=123456789012
aaws s3 cp s3://mozilla-cloudtrail-logs/AWSLogs/$account_id/CloudTrail/us-east-1/ ./ --recursive
aaws s3 cp s3://mozilla-cloudtrail-logs/AWSLogs/$account_id/CloudTrail/us-west-2/ ./ --recursive
aaws s3 cp s3://mozilla-cloudtrail-logs/AWSLogs/$account_id/CloudTrail/us-west-1/ ./ --recursive
# create search script (here's an example : https://gist.github.com/gene1wood/d0b6d1f030ab5747dad1837f53f9473f )
find ./ -type f -exec ../cloudtrail_search.py {} >> ../output.txt \;
@limed
Copy link

limed commented Mar 31, 2016

Do you mean aws or aaws from line 9-11

@gene1wood
Copy link
Author

aaws is the bash alias that the aws_assume_role script creates which calls aws with the AWS ephemeral profile. aaws is supposed to be shorthand for "assumed aws"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment