By using AWS re:Post, you agree to the Terms of Use
/AWS VPN monitor/

AWS VPN monitor

0

so far my company uses the aws client vpn, which is authenticated through the google workspace saml. the user's vpn access is authenticated by his/her google mail, is anyway I can track the user's behavior, like which aws resource he/she access or modified? is any software or service i can levelrage?

I appreciate you thoughts.

1 Answers
0

Good day.

Have you already looked into CloudTrail events? https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/monitoring-cloudtrail.html

"When activity occurs in Client VPN, that activity is recorded in a CloudTrail event along with other AWS service events in Event history."

Remember that CloudTrail only supports 90 days in the dashboard by default, and if you need to retain a longer period then you should look into CloudTrail Trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html) or integrate CloudTrail with your SIEM solution.

I hope this helps!

Jason H.

answered 7 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions