Incident response guide for AWS CloudTrail investigations – Part 2

Source: AWS Security Blog

Author: Oscar Diaz

URL: https://aws.amazon.com/blogs/security/incident-response-guide-for-aws-cloudtrail-investigations-part-2/

ONE SENTENCE SUMMARY:

An SSRF flaw stole IMDSv1 role credentials, enabling console access and cross-Region Amazon Bedrock misuse, shown through CloudTrail forensics analysis.

MAIN POINTS:

1. Describes five-stage chain: SSRF, metadata credential theft, probing, pivoting, region hopping.
2. CloudTrail CreateUser failure exposed webdev role and ec2RoleDelivery 1.0 indicating IMDSv1.
3. ConsoleLogin success without MFA revealed interactive access from same source IP.
4. ListFoundationModels in us-east-2 marked reconnaissance and intentional alternate Bedrock endpoint targeting.
5. Converse invocation confirmed Amazon Nova Pro model abuse and token counts for cost estimation.
6. Correlation hinges on consistent role ARN, session name instance ID, and sourceIPAddress.
7. Key fields: userIdentity for attribution, readOnly for intent, awsRegion for evasion.
8. Absence of userIdentity.invokedBy indicated direct credential use, not service-linked automation.
9. Investigation prioritized role over-permissioning to Bedrock and searching other instances with same role.
10. Response checklist includes fixing SSRF, enforcing IMDSv2, expanding multi-Region log queries and billing review.

TAKEAWAYS:

1. Enforce IMDSv2 with hop-limit to neutralize SSRF-based metadata credential theft.
2. Require MFA and restrict console sessions for workload roles to prevent interactive pivots.
3. Standardize monitoring and controls across all Regions to reduce cross-Region blind spots.
4. Enable Bedrock model invocation logging and telemetry to capture prompts, responses, and agent actions.
5. Apply least-privilege policies and regularly analyze unused permissions to limit lateral movement.