Is there a way to see what actions the 'g2' IAM user is performing in S3, and which IP(s) they are running from? I have already enabled the logging of S3 actions.
One point I’m still not able to figure out is that when I’m trying to find logs in Cloud trail using an AWS access key or username in both cases, I’m getting results as No matches. But throughout the day that user (g2) interacts with S3, based on the times it seems like it is a CRON running on some server. How to identify it?
I did analyze CloudTrail event history and used CloudWatch Logs Insights to find out access Logging IP address for 90 days by using both “username” and “AWS Access Key” but it seems that it isn’t of much help for finding “g2” user data. “g2” IAM user does have Administrator Access. The user does not have console management access. I suspect it is just doing an 'ls' to check for the existence of some files. I think the same actions will be occurring each day for it
I know the date/time the user executes and the resource (S3) but that is all (no bucket, no IP, etc). Is there anything we can do with that information?
I already tested these queries but was not able to get the output fields @timestamp, eventName, eventType, requestParameters.bucketName, requestParameters.key, resources.0.ARN | filter sourceIPAddress == "xx.xx.xx.xx" and userIdentity.sessionContext.sessionIssuer.userName == "g2" and eventSource == "s3.amazonaws.com" | sort @timestamp desc | limit 100 fields @timestamp, @message | filter userIdentity.userName == "g2" | sort @timestamp desc | limit 20 fields @timestamp, @message | filter sourceIPAddress == "192.168.1.1" | sort @timestamp desc | limit 20
Does Athena query of CloudTrail Logs can be helpful? Is the CLI tool CloudTrail log will be helpful for my scenario? Can anyone help me with this?