LOGS - AWS CloudTrail
CloudTrail and AWS IAM must be enabled on all regions.
CloudTrail is an AWS service that helps you with operational and risk auditing, governance, and compliance of your AWS account. Actions performed by an AWS user, role or service are logged as events in CloudTrail.
AWS IAM Access Analyzer:
helps identify your organization's resources and accounts that are shared with an external entity.
Validates IAM policies against policy grammar and best practices.
Generates IAM policies based on access activity in your AWS CloudTrail logs.
Requêtes :
Check it:
aws accessanalyzer list-analyzers --region <region-name>Activate it :
aws accessanalyzer enable-analyzer --analyzer-name "default" --type ACCOUNT --region <region-name>It is important to take into account that this action will increase the bill. So beware.
Documentations :
Last updated