Incident response guide for AWS CloudTrail investigations – Part 2

This report describes a multi-stage cloud compromise where an SSRF flaw on an EC2-hosted web application allowed an attacker to harvest IMDSv1 temporary credentials for a 'webdev' role, probe IAM permissions, establish console access without MFA, pivot from us-east-1 to us-east-2, and misuse Amazon Bedrock (including model enumeration and a Converse invocation). The guide walks through CloudTrail evidence tying the events together, highlights key investigative fields (userIdentity, readOnly, awsRegion, sourceIPAddress), outlines containment and remediation steps (enforce IMDSv2, scope Bedrock access, search for persistence), and provides defensive takeaways such as least-privilege IAM, region-consistent monitoring, and enabling Bedrock invocation logging for full visibility.