1 Respuesta
- Más nuevo
- Más votos
- Más comentarios
1
Using the AWS Console
- Open your Amazon CloudWatch console and specify a region.
- On the left hand menu, select Insights under Logs.
- Select your CloudTrail Logs group from the dropdown near the top.
- On the right, choose a relative time frame to search.
- Enter the following command into the query input, and click Run query:
filter errorCode like /Unauthorized|Denied|Forbidden/ | fields awsRegion,
userIdentity.arn, eventSource, eventName, sourceIPAddress, userAgent
You could do the same with Athena from your S3 bucket trail
Information source https://www.blinkops.com/blog/getting-a-list-of-accessdenied-events-with-users-and-source-ip-addresses
Contenido relevante
- OFICIAL DE AWSActualizada hace 3 años
- OFICIAL DE AWSActualizada hace un año