Tracking and Notifying on AWS Sign-in activities
Tags: devsecops, aws, stepfunctions, security
Published: 2022-01-08 16:08:10


It is critical to prevent root user access from getting into the wrong hands and to be aware whenever root user activity occurs in your AWS account. Here are some of the key recommendations include:

- **_Avoid using Root account_**.
- **_All IAM users including Root account must be enabled multi factor authentication (MFA)_**
- **_Abnormal activities (many failed sign-in attempts, ...)  must be detected and notified_**

However, there are certain actions that can only be performed by the root user. To be certain that all root user activity is authorized and expected, it is important to monitor root API calls to a given AWS account and to notify when this type of activity is detected. This notification gives you the ability to take any necessary steps when an illegitimate root API activity is detected or it can simply be used as a record for any future auditing needs

In order to to comply best practices above, this post I walk through a solution that tracks and notifies on root user activities and abnormal sign-in activities for an AWS account.

## Requirements

- Tracking all sign-in and related activities
- Be notified/alerted whenever Root account sign-in
- Be notified/alerted whenever an IAM user sign-in without MFA
- Be notified/alerted if the number of failed sign-in of an IAM user greater than 3 in the last hour

## Prerequisites

- Create and enable a multi-region [AWS CloudTrail](https://aws.amazon.com/cloudtrail) trail for all AWS regions

## Solution

The picture below shows a high-level architecture of the solution
[![architect.png](https://i.postimg.cc/pTGtYf8K/architect.png)](https://postimg.cc/MMQ4zj9G)

1. IAM users and/or Root account sign-in to either Web Console or Mobile Console
2. That sign-in activity is captured and tracked by Cloud Trail
3. A Cloud Trail event is sent to Event Bridge automatically
4. Event Bridge triggers a state machine in Step Function
5. The state machine process the event and send a message SNS topic if needed
6. SNS with a Lambda function subscribed to the topic will send appropriate notifications Slack

Here are details of the state machine - the main part of the solution
[![aws-sign-in-activity-step-functions.png](https://i.postimg.cc/GmzGj64V/aws-sign-in-activity-step-functions.png)](https://postimg.cc/BjLjSYcB)

At the first step in the above state machine, the activity is stored in a DynamoDB table. The reason for storing is that we will need historical data of a user for other purposes such as security audits in the future, investigating security issues, etc. We also need it for a later step in the state machine (`Count failed sign-in attempt`) to determine an alert should be sent or not.

The DynamoDB table is designed (hash key, partition key, indexes, etc.) to store not only sign-in activities but also other kinds of activities. This will help us easily to extend the solution in the future.

At the last steps of the state machine, send alert steps, SNS publish tasks are used instead of Lambda tasks is because we don't want to duplicate sending alert code. A centralized Lambda function that is subscribed to SNS topic will do sending messages to Slack via an incoming webhook.

### Scenarios

**1. Root sign-in**

- State machine execution:
[![aws-sign-in-activity-root-sign-in.png](https://i.postimg.cc/3wHVg4Dn/aws-sign-in-activity-root-sign-in.png)](https://postimg.cc/BjMm3vpK)

- Slack alert:
[![aws-sign-in-activity-root-sign-in-alert.png](https://i.postimg.cc/zvXV3Gjf/aws-sign-in-activity-root-sign-in-alert.png)](https://postimg.cc/47qJSZjC)

**2. Sign-in successful but no MFA used**

- State machine execution:
[![aws-sign-in-activity-no-mfa.png](https://i.postimg.cc/ZY7QfYQF/aws-sign-in-activity-no-mfa.png)](https://postimg.cc/G9DztRdH)

- Slack alert:
[![aws-sign-in-activity-no-mfa-alert.png](https://i.postimg.cc/fbV7RZCZ/aws-sign-in-activity-no-mfa-alert.png)](https://postimg.cc/sBRGTkb0)

**3. Sign-in failed but not more than 2 attempts**

- State machine execution:
[![aws-sign-in-activity-no-more-than-2-times.png](https://i.postimg.cc/L8pC0qm7/aws-sign-in-activity-no-more-than-2-times.png)](https://postimg.cc/HV69rkc4)

**4. More than 2 failed sign-in attempts**

- State machine execution:
[![aws-sign-in-activity-more-than-2-times.png](https://i.postimg.cc/zGGt1sRS/aws-sign-in-activity-more-than-2-times.png)](https://postimg.cc/1fbcGYBf)

- Slack alert:
[![aws-sign-in-activity-more-than-2-times-alert.png](https://i.postimg.cc/HLhs21bS/aws-sign-in-activity-more-than-2-times-alert.png)](https://postimg.cc/d7GYsXHd)

**5. Sign-in successful and MFA used**

- State machine execution:
[![aws-sign-in-activity-ok.png](https://i.postimg.cc/DzjdP0Ct/aws-sign-in-activity-ok.png)](https://postimg.cc/5HzCx4W3)

**6. Not sign-in activity**

- State machine execution:
[![aws-sign-in-activity-not-sign-in.png](https://i.postimg.cc/NjWQ9ktV/aws-sign-in-activity-not-sign-in.png)](https://postimg.cc/v4LJC9cL)