Identity
Part of Cloud security operations
Escalating a suspected cloud account compromise
Handoff a suspected cloud account compromise, preserve available evidence and coordinate containment and reporting decisions.
Escalate a credible sign of cloud account compromise promptly, even if the cause is unknown. Send the incident owner the affected account, alert time, observed activity and immediate business risk. The owner coordinates investigation, containment and communication from one incident record.
Make the first handoff clear
A suspicious sign-in, unexpected credential or unapproved administrative change can start the review. Record account and resource identifiers, timestamps with time zone, alert or event IDs, changed settings and who noticed them. Separate observations from conclusions: “a new access key was created” is an event; who created it and why require investigation.
Set escalation triggers for privileged access, possible data access, changes to logging or identity controls, and activity that continues during investigation. Name a primary incident owner and deputy in advance. If ordinary account access may be compromised, use an approved alternate contact route.
Preserve evidence and choose containment
Identify what uses the identity and what it can reach. Under the incident process, collect available management events, authentication and resource logs, current permissions and recent changes. Record gaps. AWS CloudTrail Event history, for example, shows recent regional management events but excludes data events; an empty search cannot establish that data was untouched.
The incident owner chooses containment in light of the evidence and likely disruption. Depending on the platform, actions may include disabling a credential, ending sessions, reducing permissions or isolating a resource.
Check whether temporary sessions or other credentials remain usable after a long-lived key changes. Coordinate urgent action with workload owners so legitimate services can regain access through a trusted path. Preserve relevant evidence where that can be done without prolonging active harm.
Key Evidence Sources and Limitations
- AWS CloudTrail Event History
- Shows management events; excludes data events.
- Authentication Logs
- Captures sign-in attempts and session details.
- IAM Permissions and Changes
- Tracks policy modifications and access key creation.
- Empty Search Result
- Does not prove no data was accessed—gaps must be documented.
Containment Options: Pros and Cons
- Disabling a long-lived access keyPros: Stops immediate misuse. Cons: May disrupt automated services unless replaced via trusted path.
- Ending active sessionsPros: Immediate access revocation. Cons: May affect legitimate users during investigation.
- Reducing permissionsPros: Limits damage while investigation continues. Cons: May delay critical operations.
- Isolating a resourcePros: Prevents lateral movement. Cons: High operational impact; requires coordination with workload owners.
Expand the investigation
Check which other identities the account could create, roles it could assume, settings it could change and resources it could access. Review activity from the last known expected state through containment, allowing for uncertainty about when misuse began. Look for changes that could preserve access. One password reset or disabled key does not, by itself, close the investigation.
Keep a situation record of scope, confidence, actions, owners, service impact and next update time. Assign decisions about customer, provider, insurer and regulator communications under the organisation's obligations.
Incident Investigation Timeline
- Last known good state
- Time when system was confirmed secure.
- Suspicious activity detected
- Timestamp of initial alert or observation.
- Containment initiated
- Time action taken to limit exposure.
- Investigation complete
- Time verified recovery and closure decisions made.
Close with verified access
Before normal use resumes, check who controls the identity, which credentials and sessions remain valid, whether unauthorised changes were reversed and whether an intended business action works. Continue to watch affected resources for renewed suspicious activity. Record what was verified, what remains unknown and who owns the remaining risk.
An exercise can help check contact routes, evidence access and containment decisions. Record its actual scope and result when one is performed.
