k9 now summarizes CloudTrail access capabilities

by | Dec 31, 2020 | Announcements | 0 comments

k9 Security now summarizes principals’ access to the CloudTrail APIs and reports whether principals may administer, read, or delete trails. AWS CloudTrail is a service that automatically logs activity to enable governance, compliance, operational auditing, and risk auditing. k9 Security’s daily reports now contain a summary of each principal’s access to CloudTrail.

If you’re wondering which IAM principals can administer, read, or delete the CloudTrail audit trails in your account, k9 can give you a short list to review. k9 analyzes AWS accounts to see which IAM users and roles can use CloudTrail APIs and maps each principal’s access to a k9 access capability.

Here’s an example of how CloudTrail access is summarized in the Principal Access Summary worksheet of k9-dev’s report (sample: xlsx):

This example shows the ci IAM user and the AccountAdminAccessRole-Sandbox role have administer-resource and read-datacapabilities. No principals are able to delete-data in this account even though there are principals with access to all APIs because of a Service Control Policy.

Here’s how CloudTrail’s 19 service actions are mapped to k9 access capabilities:

ActionCapability
AddTagsadminister-resource
CreateTrailadminister-resource
DeleteTrailadminister-resource, delete-data
PutEventSelectorsadminister-resource
PutInsightSelectorsadminister-resource
RemoveTagsadminister-resource
StartLoggingadminister-resource
StopLoggingadminister-resource
UpdateTrailadminister-resource
DescribeTrailsread-data
GetEventSelectorsread-data
GetInsightSelectorsread-data
GetInsightSelectorsread-data
GetTrailread-data
GetTrailStatusread-data
ListPublicKeysread-data
ListTagsread-data
ListTrailsread-data
LookupEventsread-data
Table 1: Map of CloudTrail API actions to k9 Access Capabilities

The CloudTrail API actions allowing creation, deletion, and configuration of audit trails are mapped to administer-resource. The DeleteTrail action is also mapped to the delete-data capability because it deletes audit trail data. Actions used to list and read data from trails are mapped to the read-data capability.

We hope k9’s new CloudTrail analysis capabilities help you identify which IAM users and roles can use administer and read audit trails in your AWS accounts. We are happy to answer any questions!