- Nationwide Digital Forensic & Cyber Investigation Services
Cloud infrastructure breaks the assumption that evidence lives on a physical disk you can seize. In AWS, the record of what happened lives across CloudTrail, VPC Flow Logs, S3 access logs, and snapshots, and much of it depends entirely on what logging was configured before the incident began.
| Question | One line answer |
|---|---|
| Does every AWS account have CloudTrail? | Yes, Event history covering management events is available for 90 days with no setup, but a configured trail is needed for longer retention and data events. |
| What are data events? | Object level API calls like S3 GetObject that show exactly which files were accessed, which is not captured by default. |
| Can you tell if data left an S3 bucket? | With S3 server access logging or CloudTrail data events enabled, yes; without either enabled beforehand, it is very difficult to prove after the fact. |
| Can a compromised EC2 instance be imaged? | Yes, through an EBS snapshot of the attached volumes, which preserves a point in time forensic copy. |
| What is IMDS abuse? | Exploitation of the instance metadata service to steal temporary IAM credentials, often through a server side request forgery vulnerability. |
| Who should lead an AWS incident investigation? | An examiner familiar with IAM, CloudTrail, and the specific AWS services in use, working alongside cloud engineering. |
| Term | What it means |
|---|---|
| CloudTrail | The AWS service that records API calls made against an account, including who made the call, from where, and what action was taken. |
| Event history | The free, always on 90 day rolling view of management events available in every AWS account without any configuration. |
| Trail | A configured CloudTrail resource that delivers events to an S3 bucket or CloudWatch Logs for retention beyond 90 days and for data event capture. |
| VPC Flow Logs | Records of IP traffic metadata to and from network interfaces in a VPC, showing source, destination, port, and byte counts without payload content. |
| S3 server access logging | Detailed records of requests made to an S3 bucket, including the requester and the specific object accessed. |
| IMDS | Instance Metadata Service, an endpoint available to EC2 instances that can expose temporary IAM credentials if abused through server side request forgery. |
CloudTrail is the single most important evidence source in an AWS compromise, and understanding the difference between what exists automatically and what requires prior configuration determines what an investigation can actually prove.
Many organizations assume CloudTrail simply exists and retains everything, discover during an incident that Event history covers only management events, and find that the specific data event logging needed to prove what was read from a bucket was never enabled. This is the AWS equivalent of discovering after a break in that the security camera was pointed at the wrong door the entire time.
CloudTrail tells an examiner what API calls were made. It does not tell them what network traffic actually flowed, or what happened inside a bucket at the object level unless data events were enabled. Two additional log sources fill that gap, and both require configuration before the fact.
| Log source | What it shows | Configuration requirement | Typical retention if enabled |
|---|---|---|---|
| VPC Flow Logs | Source, destination, port, protocol, and byte count for network flows in and out of a VPC or subnet | Must be enabled per VPC, subnet, or network interface | Delivered to S3 or CloudWatch Logs, retained per configured lifecycle |
| S3 server access logging | Requester identity, bucket and key accessed, response status, and bytes transferred for each request | Must be enabled per bucket, delivering logs to a target bucket | Retained per the target bucket lifecycle policy configured |
| CloudTrail data events | Object level API activity such as GetObject and PutObject tied to an identity | Must be enabled per trail and resource selector | Retained per trail configuration, commonly matching the management event trail |
When data events, flow logs, and access logging were never turned on, an examiner is left correlating what remains: management event history for account and IAM activity, EBS snapshots of running instances, and any application level logs the workload itself produced. The finding in that scenario is often that access cannot be ruled in or out with confidence, which is itself an important and honest conclusion to give counsel and a carrier.
CloudTrail Event history rolls off on a schedule regardless of when the intrusion is discovered. We can export what remains and stand up longer term logging immediately.
Cloud forensics still requires disk level evidence when malware, a web shell, or attacker tooling was placed on a running instance. The mechanism differs from a traditional seizure, but the goal is the same: a defensible, hashed, point in time copy.
Isolate the affected instance at the network layer using a restrictive security group rather than stopping it, to preserve volatile state where possible.
Snapshot every EBS volume attached to the instance before any remediation or termination action is taken.
Copy the snapshot to a forensic account or region under examiner control, and generate a hash of the resulting volume for integrity documentation.
Capture the IAM role attached to the instance and review IMDS access patterns for signs of credential theft through server side request forgery.
Export the relevant CloudTrail, flow log, and access log ranges for the instance, its role, and any buckets it accessed, before retention windows close.
A large share of AWS compromises begin with credential exposure rather than a vulnerability in AWS itself: a long lived access key committed to a public code repository, an overly permissive role assumed by a compromised application, or temporary credentials stolen through IMDS abuse.
Long lived IAM user access keys leaked in source control or misconfigured environment variables remain a leading initial access vector.
Roles granted far broader permissions than the workload needs turn a minor application compromise into a full account compromise.
A server side request forgery vulnerability in a web application can be used to query the instance metadata service and steal temporary role credentials.
Compromised credentials with assume role permissions can move into other member accounts in an AWS organization, expanding scope well beyond the original account.
CloudTrail management events reliably capture the use of stolen credentials, including the source IP, user agent, and every action taken, which is why even organizations without data event logging can usually reconstruct the IAM side of a compromise if the 90 day window has not yet closed.
Event history covers management events only for 90 days; data events showing object level access require explicit configuration.
Snapshotting the attached volumes before any state change preserves more evidence and is a better first step in most cases.
Flow logs must be explicitly enabled per VPC, subnet, or interface; nothing is captured unless someone turned it on.
Assume role permissions and cross account trust relationships can let a compromised credential reach far beyond its home account.
We are engaged by businesses, managed service providers, and cyber insurance carriers to investigate AWS compromises ranging from a single exposed access key to organization wide account takeover. Our examiners work directly with cloud engineering teams to acquire evidence correctly and quickly, and we document exactly what the available logging can and cannot establish.
Same day export of Event history, configured trails, flow logs, and S3 access logs before retention and rolloff eliminate them.
Forensically sound point in time imaging of compromised instances without unnecessary downtime or evidence loss.
Reconstruction of how a credential was obtained and everywhere it was used, including cross account activity.
Correlation of access logs and data events, where available, to determine what objects were accessed or downloaded.
A defensible written account of initial access, dwell time, and scope for counsel, carriers, and regulators.
Court qualified examiners able to explain AWS logging architecture and defend findings under cross examination.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Event history is a free, always on view of management events retained for a rolling 90 days in every account with no setup required. A configured trail actively delivers events to an S3 bucket or CloudWatch Logs, enabling retention beyond 90 days and the capture of data events, which Event history does not include.
Only if S3 server access logging or CloudTrail data events were enabled on that bucket before the activity occurred. Without either configured in advance, there is generally no reliable object level access record, which is why enabling them proactively matters far more than trying to add them after a breach.
Snapshotting the attached EBS volumes before any state change is usually the better first step, since it preserves a forensic copy without necessarily destroying volatile evidence. Isolating the instance at the network layer with a restrictive security group is often safer than stopping or terminating it outright.
A server side request forgery vulnerability in an application running on an EC2 instance can be used to query the instance metadata service, which can expose temporary IAM role credentials attached to that instance. Those credentials can then be used from outside the instance until they expire or are revoked.
No. Flow logs record metadata such as source and destination IP addresses, ports, protocol, and byte counts, not payload content. They are useful for proving that a connection occurred and estimating data volume, but not for reading what was actually transmitted.
The investigation relies on the 90 day CloudTrail Event history for management events, EBS snapshots of affected instances, and any application level logs available. Findings in that scenario are often more limited, and a defensible report will explicitly state what could not be determined due to the absence of enabled logging.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder