Show sensitive data in cloudwatch cloudtrail logs
Hello,
I collect some logs with cloudtrail. The log in question shows me when a termination/stop protection value of a virtual machine has been changed.
I don't understand why it comes out this way (screen below). I wish <sensitiveDataRemoved> wasn't there.
I don't use any services that block these entries for me. How can I proceed?
- Newest
- Most votes
- Most comments
Hello,
Thank you for your query regarding CloudTrail logs and the <sensitiveDataRemoved> field in the ModifyInstanceAttribute API event. I understand your concern about not being able to see the full details of the changes made to the termination/stop protection value of your virtual machine.
I can provide you with the following explanation and potential workarounds:
1. Explanation for <sensitiveDataRemoved>:
AWS does not store or pass sensitive information from user data to the CloudTrail service during event creation. This is in line with AWS's commitment to privacy and security, as outlined in the AWS Shared Responsibility Model [1]. The EC2 service specifically does not store sensitive information that might be present in user data, which is why you see <sensitiveDataRemoved> in the CloudTrail logs.
2. Workarounds to track changes:
I can suggest two workarounds to help you track changes to your instance attributes:
a. Install and configure Auditd on your EC2 Linux instance:
Auditd is the user-space component of the Linux Audit system. It can track user activity, file changes, and directory changes on your EC2 instance. This tool is particularly useful for:
- Tracking which users or applications are accessing or modifying files and directories
- Monitoring specific command executions
You can find instructions on how to install and configure Auditd in the AWS documentation on "Auditing Users on Linux Instances" [2].
b. Monitor user data changes locally:
On Linux instances, user data is stored in the /var/lib/cloud/instance/user-data.txt file. You can:
- Export this file to local storage periodically.
- Monitor your CloudTrail events for ModifyInstanceAttribute API calls.
- When a modification is detected, compare the current user-data file with your previously stored version to identify specific changes.
These methods should provide you with more detailed information about changes to your instance attributes, including termination/stop protection values.
If you have any further questions or need additional assistance, please don't hesitate to ask.
References:
[1] AWS Shared Responsibility Model: https://aws.amazon.com/compliance/shared-responsibility-model/
[2] Auditing Users on Linux Instances: https://repost.aws/knowledge-center/ec2-linux-track-changes
Hi,
It seems that you need to implement CloudWatch Sensitive Data Masking to achieve your goal: see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html
It gives you the opportunity to mask pieces of data (like AWS resource id) as soon as you can define a pattern / regex for theses data chunks.
You have some examples here:
- https://aws.amazon.com/blogs/aws/protect-sensitive-data-with-amazon-cloudwatch-logs/
- https://blog.awsfundamentals.com/masking-sensitive-data-with-amazon-cloudwatch-logs-data-protection-policies
Best,
Didier
Hi, the problem is opposite, I want to see this information, is there any way I can do this?
Hey, To display sensitive data in your CloudTrail logs, ensure no data protection policies are applied in CloudWatch that mask information. Also, verify that your IAM permissions allow full access to the logs. If you're part of an AWS Organization, check if any Service Control Policies are restricting this visibility. Adjust the settings, and the sensitive data should appear unless it's restricted by AWS default policies.
Hello, I have nothing active and no control over sensitive data. I also do not have scp enabled. I am an identity center user but with administrator privileges.
Relevant content
asked 5 years ago
- AWS OFFICIALUpdated 5 months ago
Sorry I am a little confused. What are you trying achieve?