Monitoring AWS Logins

Monitoring the control plane is the first step in securing your cloud environment. And within the control plane, authentication is the first area to focus on: who is logging in to AWS, from where, and which credentials they are using. This room walks you through the most common attacks against AWS identities and the defenses used to protect them.

Learning Objectives

• Understand the concept of IAM, access keys, roles, and policies
• Learn how CloudTrail logs different methods of logins in AWS
• Explore real-world cloud breaches and learn how to avoid them
• Practice the acquired knowledge in a series of mini-challenges

Prerequisites

• AWS Security Logging
• Splunk: The Basics
• Preferably, Introduction to AWS module
• Preferably, SOC Level 1 Analyst path

Lab Access

Start the lab by clicking the Start Lab Machine button below. You will then have access to the Splunk Web Interface. Please wait 4-5 minutes for the Splunk instance to launch. To access Splunk, follow this link:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Lab Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Lab machine

Status:Off

Start Lab Machine