AWS VPN monitor

Question

so far my company uses the aws client vpn, which is authenticated through the google workspace saml. the user's vpn access is authenticated by his/her google mail, is anyway I can track the user's behavior, like which aws resource he/she access or modified? is any software or service i can levelrage?

I appreciate you thoughts.

Answer

Good day.

Have you already looked into CloudTrail events? https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/monitoring-cloudtrail.html

"When activity occurs in Client VPN, that activity is recorded in a CloudTrail event along with other AWS service events in Event history."

Remember that CloudTrail only supports 90 days in the dashboard by default, and if you need to retain a longer period then you should look into CloudTrail Trails (https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html) or integrate CloudTrail with your SIEM solution.

I hope this helps!

Jason H.

AWS VPN monitor

Relevant content