Anomalous API Gateway API key reads by user

Classification:

attack

Tactic:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when a user is enumerating API Gateway API keys.

Baseline GetApiKeys events by @userIdentity.session_name to surface anomalous GetApiKeys calls.

Investigate activity for the following ARN {{@userIdentity.arn}} using {{@userIdentity.session_name}}.
Review any other security signals for {{@userIdentity.arn}}.