Best Practices for Monitoring and Investigating AWS Events

**Executive summary:** This whitepaper describes best practices for monitoring and investigating AWS activity, using examples of a misconfigured S3 bucket that enabled an attacker to alter SDK code and a suspicious TerminateInstances event; it outlines key artifacts to collect, a stepwise analysis methodology, recommended IAM and logging configurations (CloudTrail/CloudWatch), and remediation actions to contain and recover from incidents.