AWS Cloud Practitioner #14: CloudTrail - Auditoría y Compliance

Lunes 9:00 AM - Production database eliminada
 
CTO: "¿Quién eliminó la database?"
Tú: "No sé, no tenemos logs"
 
CTO: "¿Cuándo pasó?"
Tú: "No sé"
 
CTO: "¿Desde qué IP?"
Tú: "No sé"
 
Resultado:
❌ Imposible identificar culpable
❌ No sabemos si fue error o ataque
❌ No podemos prevenir recurrencia
❌ Compliance audit = FAIL

9:05 AM - Query CloudTrail
 
Resultado:
✅ User: juan@empresa.com
✅ Action: rds:DeleteDBInstance
✅ Time: 2025-11-16 08:47:32 UTC
✅ IP: 203.0.113.50
✅ User Agent: AWS Console
✅ Request ID: abc-123-def
 
Acción: Contactar Juan, revisar proceso, prevenir

CloudTrail logs:
✅ Quién (User/Role)
✅ Qué (Action)
✅ Cuándo (Timestamp)
✅ Dónde (Source IP, Region)
✅ Cómo (Console, CLI, SDK)
✅ Resultado (Success/Failure)
 
Eventos capturados:
- IAM actions (create user, change password)
- EC2 actions (launch, terminate instance)
- S3 actions (create bucket, delete object)
- RDS actions (create/delete database)
- TODO en AWS

Control plane operations:
 
Ejemplos:
- CreateUser (IAM)
- RunInstances (EC2)
- CreateBucket (S3)
- CreateDBInstance (RDS)
 
Default: Logged automáticamente

Data plane operations (high volume):
 
Ejemplos:
- GetObject (S3)
- PutObject (S3)
- Invoke (Lambda)
 
Default: NO logged (demasiados events)
Habilitar: Manual, costo adicional

Detección de actividad inusual:
 
Ejemplos:
- Spike en IAM actions
- Burst de EC2 launches
- Unusual API error rates
 
Machine learning detecta anomalías

Trail components:
- Event types (Management, Data)
- Regions (Single o All)
- S3 bucket (storage)
- CloudWatch Logs (monitoring)
- SNS topic (notifications)

# Create S3 bucket para logs
aws s3 mb s3://mi-empresa-cloudtrail-logs
 
# Create trail
aws cloudtrail create-trail \
  --name company-trail \
  --s3-bucket-name mi-empresa-cloudtrail-logs \
  --is-multi-region-trail \
  --enable-log-file-validation
 
# Start logging
aws cloudtrail start-logging \
  --name company-trail
 
# Verify
aws cloudtrail get-trail-status \
  --name company-trail

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDAI23HXH2EXAMPLE",
    "arn": "arn:aws:iam::123456789012:user/juan",
    "userName": "juan",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2025-11-16T08:45:12Z"
      }
    }
  },
  "eventTime": "2025-11-16T08:47:32Z",
  "eventSource": "rds.amazonaws.com",
  "eventName": "DeleteDBInstance",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.50",
  "userAgent": "console.amazonaws.com",
  "requestParameters": {
    "dBInstanceIdentifier": "production-db",
    "skipFinalSnapshot": true
  },
  "responseElements": {
    "dBInstanceStatus": "deleting"
  },
  "requestID": "abc-123-def-456",
  "eventID": "xyz-789-ghi-012",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "recipientAccountId": "123456789012"
}

Pregunta: "¿Alguien modificó Security Groups?"
 
Query CloudTrail:
Event: AuthorizeSecurityGroupIngress
Filter: Last 24 hours
 
Resultado:
User: admin@empresa.com
Action: Added rule 0.0.0.0/0:22
Time: 2025-11-16 14:30:00
 
⚠️ Alerta: SSH abierto a internet
→ Investiga: ¿Intencional? ¿Legítimo?
→ Acción: Revierte si malicioso

Audit requirement:
"Mostrar quién accedió customer data en último mes"
 
CloudTrail query:
- Events: S3:GetObject
- Resource: s3://customer-data/*
- Time: Last 30 days
 
Export to report:
- Lista de users
- Access timestamps
- Cumple compliance ✅

Problema: "EC2 instance no arranca"
 
CloudTrail shows:
Event: RunInstances
Error: "InsufficientInstanceCapacity"
Time: 10:30 AM
 
Root cause: AWS capacity issue
Action: Launch en otra AZ

Pregunta: "¿Cuándo se creó este S3 bucket?"
 
CloudTrail:
Event: CreateBucket
Bucket: mi-bucket
User: terraform-role
Time: 2025-01-15 09:00:00
 
Contexto: Terraform deployment

CloudTrail vs. Config:
 
CloudTrail:
- QUIÉN hizo QUÉ y CUÁNDO
- API call history
- "Juan deleted DB at 8:47 AM"
 
Config:
- CÓMO está configurado
- Resource configuration history
- "DB had Multi-AZ disabled"
- Compliance rules

Reglas predefinidas o custom:
 
Ejemplos:
1. s3-bucket-public-read-prohibited
   → Alert si S3 bucket es público
 
2. ec2-instance-no-public-ip
   → Alert si EC2 tiene Public IP en prod
 
3. rds-multi-az-enabled
   → Alert si RDS NO tiene Multi-AZ
 
4. required-tags
   → Alert si resource NO tiene tags requeridos
 
Custom:
Lambda function que evalúa compliance

# Enable AWS Config
aws configservice put-configuration-recorder \
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/ConfigRole
 
# Start recording
aws configservice start-configuration-recorder \
  --configuration-recorder-name default
 
# Add rule: S3 bucket encryption
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "s3-bucket-encryption-enabled",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
    }
  }'
 
# Query compliance
aws configservice describe-compliance-by-config-rule
 
# Output:
# Compliant: 15 buckets
# Non-Compliant: 3 buckets (sin encryption)

1. Enable in ALL regions:
   ✅ Multi-region trail
   ✅ Captura events en todas las regiones
   ❌ NO solo region actual
 
2. Enable log file validation:
   ✅ Detecta si logs fueron modificados
   ✅ Cryptographic hash
   ✅ Integridad garantizada
 
3. Encrypt logs:
   ✅ S3 bucket encryption (SSE-KMS)
   ✅ Logs sensibles protegidos
 
4. Lifecycle logs:
   ✅ S3: Standard (30 días)
   ✅ S3 IA (31-90 días)
   ✅ Glacier (91-365 días)
   ✅ Delete (>365 días si compliance permite)
 
5. Send to CloudWatch Logs:
   ✅ Real-time monitoring
   ✅ Metric filters
   ✅ Alarms
 
6. Restrict access:
   ✅ S3 bucket policy: Solo CloudTrail puede write
   ✅ IAM: Solo security team puede read
   ✅ MFA delete para bucket
 
7. Notifications:
   ✅ SNS topic para critical events
   ✅ Alert si root account usado
   ✅ Alert si security group modificado

PCI-DSS (Payment Card):
- CloudTrail: Audit accesos
- Config: Verify encryption enabled
- Guardar logs 1 año mínimo
 
HIPAA (Healthcare):
- CloudTrail: Track PHI access
- Config: Verify encryption
- Guardar logs según retention policy
 
GDPR (EU Privacy):
- CloudTrail: Data access audit
- Config: Data residency compliance
- Right to be forgotten (delete logs si requested)
 
SOC 2:
- CloudTrail: Audit trail completo
- Config: Security controls
- Logs immutability

CloudTrail logs en S3 → Difficult to search
 
Solución: Amazon Athena
SQL queries sobre S3 logs

-- Create table en Athena
CREATE EXTERNAL TABLE cloudtrail_logs (
  eventVersion STRING,
  userIdentity STRUCT<
    type: STRING,
    principalId: STRING,
    arn: STRING,
    userName: STRING
  >,
  eventTime STRING,
  eventName STRING,
  awsRegion STRING,
  sourceIPAddress STRING,
  userAgent STRING,
  requestParameters STRING,
  responseElements STRING
)
PARTITIONED BY (
  region STRING,
  year STRING,
  month STRING,
  day STRING
)
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://mi-empresa-cloudtrail-logs/';
 
-- Query: ¿Quién lanzó EC2 instances hoy?
SELECT
  userIdentity.userName,
  eventTime,
  requestParameters
FROM cloudtrail_logs
WHERE eventName = 'RunInstances'
  AND year = '2025'
  AND month = '11'
  AND day = '16'
ORDER BY eventTime DESC;
 
-- Query: Acciones desde IP sospechosa
SELECT
  eventName,
  eventTime,
  userIdentity.userName
FROM cloudtrail_logs
WHERE sourceIPAddress = '198.51.100.50'
ORDER BY eventTime DESC;