Auditing AWS events/logs to find when LucidScale makes connection

Question

I want to find out how can we audit AWS events/logs to see when lucidscale (a third party application) makes a connection. I already looked into AWS CloudTrail, CloudWatch but I didn't find anything there.     
Here is the link that shows how I imported AWS data to LucidScale for diagramming purpose:   
https://lucidscale.zendesk.com/hc/en-us/articles/4407993351188#import-aws-accounts-and-create-models-via-cross-account-role                  
(Import AWS Accounts and Create Models via Cross-Account Role)

Thanks for your help.

Accepted Answer

You're on the right track. Any time a role is assumed, the API call is stored in CloudTrail. Try looking back in CloudTrail for any events named AssumeRole. If you have multiple users/accounts assuming multiple roles throughout the day, you may have to dig through a few events to find the one(s) from LucidScale. I've pasted an example CloudTrail log below of a user named 'jsmith' assuming a role so you can see sort of what you're looking for and what information is included. 
```
{
     "version": "0",
     "id": "c204c067-a376-47a8-a760-f0bf97b89aae",
     "detail-type": "AWS API Call via CloudTrail",
     "source": "aws.sts",
     "account": "1111111111111",
     "time": "2016-04-05T20:39:37Z",
     "region": "us-east-1",
     "resources": [],
     "detail": {
         "eventVersion": "1.04",
         "userIdentity": {
             "type": "IAMUser",
             "principalId": "AIDAIDVUOOO7V6R6HKL6E",
             "arn": "arn:aws:iam::1111111111111:user/jsmith",
             "accountId": "1111111111111",
             "accessKeyId": "AKIAJ2DZP3QVQ3D6VJBQ",
             "userName": "jsmith"
         },
         "eventTime": "2016-04-05T20:39:37Z",
         "eventSource": "sts.amazonaws.com",
         "eventName": "AssumeRole",
         "awsRegion": "global",
         "sourceIPAddress": "72.21.196.66",
```

Once you have this information, you can use EventBridge to create a rule to send an alert to an SNS topic any time that role is assumed. More info [here](https://aws.amazon.com/premiumsupport/knowledge-center/sns-email-notifications-eventbridge/). The rule would look something like this, assuming that the account Lucid is assuming the role with is 111111111111:

```
{
  "source": ["aws.cloudtrail"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventSource": ["cloudtrail.amazonaws.com"],
    "eventName": ["AssumeRole"],
    "accountid": ["1111111111111"]
  }
}
```
Using this method, you can get an email, text, or even Slack notification anytime the role is assumed. One thing to note is CloudTrail is **not** real time, so when receive the alert there could have been up to a 15 minute delay since the role was actually assumed. Hope this helps!

Auditing AWS events/logs to find when LucidScale makes connection

Contenuto pertinente