API

AWS root account activity

Docs > Plateforme de sécurité Datadog > OOTB Rules > AWS root account activity

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect AWS root user activity.

Strategy

Monitor CloudTrail and detect when any @userIdentity.type has a value of Root, but is not invoked by an AWS service or SAML provider.

Triage and response

Determine if the root API Call: {{@evt.name}} is expected.
If the action wasn’t legitimate, rotate the credentials, enable 2FA, and open an investigation.

For best practices, check out the AWS Root Account Best Practices documentation.
For compliance, check out the CIS AWS Foundations Benchmark controls documentation.