01 Run create-user command (OSX/Linux/UNIX) to create the required AWS IAM user account:
aws iam create-user
--user-name Jeff
02 The command output should return the new IAM user metadata:
{
"User": {
"UserName": "Jeff",
"Path": "/",
"CreateDate": "2019-01-08T17:39:20Z",
"UserId": "AABBCCDDAABBCCDDAABBC",
"Arn": "arn:aws:iam::123456789012:user/Jeff"
}
}
03 Run create-access-key command (OSX/Linux/UNIX) to generate and attach an access key pair to the newly created AWS IAM user. The key pair will be used later as decoy to implement threat deception:
aws iam create-access-key
--user-name Jeff
04 The command output should return the new IAM user access key ID and a secret access key (including other metadata)
{
"AccessKey": {
"UserName": "Jeff",
"Status": "Active",
"CreateDate": "2019-01-08T17:41:15Z",
"SecretAccessKey": "abcd1234abcd1234abcd1234abcd1234abcd1234",
"AccessKeyId": "AAAABBBBCCCCDDDDEEEE"
}
}
05 Run create-subscription command (OSX/Linux/UNIX) to create the Amazon CloudTrail trail that will record the necessary AWS API events and save them to log files within an S3 bucket:
aws cloudtrail create-subscription
--region us-east-1
--name cc-canary-auth-trail
--s3-new-bucket cc-canary-auth-logs
06 If successful, the command output should return the new CloudTrail trail metadata:
{
Setting up new S3 bucket cc-canary-auth-logs...
Creating/updating CloudTrail configuration...
CloudTrail configuration:
{
"trailList": [
{
"IncludeGlobalServiceEvents": true,
"Name": "cc-canary-auth-trail",
"TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/cc-canary-auth-trail",
"LogFileValidationEnabled": false,
"IsMultiRegionTrail": false,
"HasCustomEventSelectors": false,
"S3BucketName": "cc-canary-auth-logs",
"HomeRegion": "us-east-1"
}
],
"ResponseMetadata": {
"RetryAttempts": 0,
"HTTPStatusCode": 200,
"RequestId": "abcdabcd-1234-1234-1234-abcdabcdabcd",
"HTTPHeaders": {
"x-amzn-requestid": "abcdabcd-1234-1234-1234-abcdabcdabcd",
"date": "Mon, 08 Apr 2019 18:02:35 GMT",
"content-length": "345",
"content-type": "application/x-amz-json-1.1"
}
}
}
Starting CloudTrail service...
Logs will be delivered to cc-canary-auth-logs:}
07 Run create-log-group command (OSX/Linux/UNIX) to create the AWS CloudWatch log group required to receive API events from Amazon CloudTrail for monitoring (the command does not produce an output):
aws logs create-log-group
--region us-east-1
--log-group-name CloudTrail/CanaryAuthLogGroup
08 Run describe-log-groups command (OSX/Linux/UNIX) to obtain the Amazon Resource Name (ARN) of the CloudWatch log group created at the previous step:
aws logs describe-log-groups
--region us-east-1
--log-group-name-prefix CloudTrail/CanaryAuthLogGroup
--query 'logGroups[*].arn'
09 The command output should return the requested resource ARN:
{
"arn:aws:logs:us-east-1:122330079136:log-group:CloudTrail/CanaryAuthLogGroup:*"
]
10 Create the policy for the IAM role that AWS CloudWatch needs to assume, and paste the following content to a file named assume-role-policy.json:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
11 Run create-role command (OSX/Linux/UNIX) to create the IAM role that enables CloudTrail to send events to the new AWS CloudWatch log group:
aws iam create-role
--role-name CloudTrail_CloudWatchLogs_Role
--assume-role-policy-document file://assume-role-policy.json
12 Create the IAM role access policy that will grant Amazon CloudTrail the required permissions to create CloudWatch log streams in the log group created earlier in the process. Replace the highlighted values with your own configuration data and save the policy to a file named cloudtrail-cloudwatch-role-policy.json:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailCreateLogStream",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:log-stream:123456789012_CloudTrail_us-east-1*"
]
},
{
"Sid": "AWSCloudTrailPutLogEvents",
"Effect": "Allow",
"Action": [
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:log-stream:123456789012_CloudTrail_us-east-1*"
]
}
]
}
13 Run put-role-policy command (OSX/Linux/UNIX) to apply the policy defined at the previous step, i.e. cloudtrail-cloudwatch-role-policy.json, to the required AWS IAM role:
aws iam put-role-policy
--role-name CloudTrail_CloudWatchLogs_Role
--policy-name cloudtrail-cloudwatch-role-policy
--policy-document file://cloudtrail-cloudwatch-role-policy.json
14 Run update-trail command (OSX/Linux/UNIX) to update your CloudTrail trail configuration with the AWS CloudWatch log group and IAM role information. Replace the specified log group and role ARNs with your own ARNs:
aws cloudtrail update-trail
--region us-east-1
--name cc-canary-auth-trail
--cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/CanaryAuthLogGroup:*
--cloud-watch-logs-role-arn arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role
15 The command output should return the new AWS CloudTrail trail configuration:
{
"IncludeGlobalServiceEvents": true,
"Name": "cc-canary-auth-trail",
"TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/cc-canary-auth-trail",
"LogFileValidationEnabled": false,
"S3BucketName": "cc-canary-auth-logs",
"CloudWatchLogsRoleArn": "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role",
"CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/CanaryAuthLogGroup:*"
}
16 Run put-metric-filter command (OSX/Linux/UNIX) to create the required metric filter and associate it with the specified CloudWatch log group. This metric implements a Filter Pattern that matches the access key ID created at step no. 3 (i.e. the Canarytoken). Replace "AAAABBBBCCCCDDDDEEEE" with your own access key ID (the command does not produce an output):
aws logs put-metric-filter
--region us-east-1
--log-group-name CloudTrail/CanaryAuthLogGroup
--filter-name cc-canary-log-filter
--filter-pattern "{ $.userIdentity.accessKeyId = \"AAAABBBBCCCCDDDDEEEE\" }"
--metric-transformations metricName=cc-canary-log-metric,metricNamespace=LogMetrics,metricValue=1
17 The command output should return the ARN for the newly created AWS SNS topic:
{
"TopicArn": "arn:aws:sns:us-east-1:12345678901:cc-vpc-flow-log-notifications "
}
18 To set up the notification system, run create-topic command (OSX/Linux/UNIX) to create a new SNS topic for sending email notifications whenever the required AWS CloudWatch alarm is triggered:
aws sns create-topic
--name cc-canary-auth-notifications
19 The command output should return the ARN for the newly created AWS SNS topic:
{
"TopicArn": "arn:aws:sns:us-east-1:123456789012:cc-canary-auth-notifications"
}
20 Run subscribe command (OSX/Linux/UNIX) to send the subscription confirmation message to the notification endpoint (the email address provided as endpoint):
aws sns subscribe
--region us-east-1
--topic-arn arn:aws:sns:us-east-1:123456789012:cc-canary-auth-notifications
--protocol email
--notification-endpoint notifyme@cloudconformity.com
21 The command output should return the following:
{
"SubscriptionArn": "pending confirmation"
}
22 Run confirm-subscription command (OSX/Linux/UNIX) to confirm the email subscription by validating the token sent to the notification endpoint selected:
aws sns confirm-subscription
--topic-arn arn:aws:sns:us-east-1:123456789012:cc-canary-auth-notifications
--token de76e15f37fb687f5d51e6e241d7700ae02f7124d8268910b858cb4db727cesb2474bb937929d3bdd7ce5d0cce19325d036bc498d3c217426bcafa9c501a2cace93b83f1dd3797627467553dc438a8c974119496fc3eff026eaa5d14472ded6f9a5c43aec62d83ef5f49109da71efb7gx78
23 The command output should return the confirmed subscription ARN:
{
"SubscriptionArn": "arn:aws:sns:us-west-2:123456789012:cc-canary-auth-notifications:abcdabcd-1234-1234-1234-abcd1234abcd"
}
24 Run put-metric-alarm command (OSX/Linux/UNIX) to create the Amazon CloudWatch alarm that fires whenever someone attempts to use the access keys pair defined as Canarytoken (if successful, the command does not return an output):
aws cloudwatch put-metric-alarm
--region us-east-1
--alarm-name cc-canary-auth-alarm
--alarm-description "Triggered by Canarytoken usage."
--metric-name cc-canary-log-metric
--namespace LogMetrics
--statistic Sum
--comparison-operator GreaterThanOrEqualToThreshold
--evaluation-periods 1
--period 300
--threshold 1
--actions-enabled
--alarm-actions arn:aws:sns:us-east-1:123456789012:cc-canary-auth-notifications
25 Now that the required notification system is created, place the API access keys created at step no. 3 as Canarytoken in locations that an attacker is likely to look in case of a security breach, e.g. web applications, code repositories, EC2 instances.
26 If required, change the AWS region by updating the --region command parameter value and repeat the entire remediation process for other regions.
Security 