AWS IAM Forensics &

Incident Response

Cado Security | 1
 What is AWS IAM?

https://blog.gitguardian.com/aws-iam-security-best-practices/
What are Policies?
How does IAM Work
Under the Hood?
 What is Identity Federation?

“How to Establish Federated Access to Your AWS Resources by Using Active Directory
User Attributes” - AWS.com
 What AWS IAM Logging is there?
AWS CloudTrail captures all API calls for IAM and AWS STS as events, including calls
from the console and API calls.

AWS Identity and Access Management Access Analyzer helps you identify the resources
in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared
with an external entity. This helps you identify unintended access to your resources and
data, which is a security risk.

https://docs.aws.amazon.com/IAM/latest/UserGuide/security-logging-and-monitoring.html
Cado Response
Free 14-day trial
Receive unlimited access to the
Cado Response Platform for 14
days.

www.cadosecurity.com/free-investigation/