30.5 Detection: CloudTrail, GuardDuty, Config and Security Hub
You cannot defend what you cannot see. AWS gives four key detection services:
| Service | What it does | Think of it as |
|---|---|---|
| CloudTrail | Records every API call: who did what, when, from which IP | The account's CCTV recording |
| GuardDuty | Analyses CloudTrail, VPC Flow Logs and DNS logs to spot threats (crypto-mining, calls from known bad IPs, unusual logins) | An automatic security guard |
| AWS Config | Tracks configuration changes and checks rules like "no public S3" or "EBS must be encrypted" | A compliance checklist that runs itself |
| Security Hub | Collects findings from GuardDuty, Config, Inspector and more into one dashboard with best-practice scores | The control room |
Minimum setup for any real account:
- Create a multi-region CloudTrail trail that writes to a dedicated S3 bucket (with Block Public Access and versioning on).
- Enable GuardDuty and send high-severity findings to your email through EventBridge and SNS.
- Keep a billing alarm (Chapter 12) – a sudden bill spike is often the first sign of stolen keys.
- Turn on VPC Flow Logs for the VPC to see accepted and rejected network traffic.
# Who deleted something recently? Look up events in CloudTrail
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket --max-results 5
# Any console logins without MFA?
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --max-results 10
Ravindra Bagale's Tip
CloudTrail chalu nasel tar hack zalyavar "kay zala" he kadhich kalnar nahi. Logs he investigation cha pahila puravaa (evidence) aahet. Account ughadlya divashich trail ani billing alarm lava – nantar nahi.
Lab
Create a multi-region trail. Make a harmless change (create and delete an empty test bucket), then find both events in CloudTrail Event history and note the user, time and source IP. If you enable the GuardDuty free trial, open Settings, Generate sample findings and read three findings. Disable anything you will not keep after the lab.