AWS Threat Lab for Splunk
- DFIR Radar published an AWS threat-detection lab showing Splunk ingestion for CloudTrail and VPC Flow Logs using Terraform and SQS. - The lab includes an SPL example for IAM privilege escalation events using CreateUser, AttachUserPolicy, and CreateAccessKey actions. - Use this lab as a template to build multi-tenant detection rules and automated ingestion during rapid client onboarding (x.com).
A new AWS threat-detection lab from DFIR Radar lays out a working path to pull CloudTrail and VPC Flow Logs into Splunk with Terraform and Amazon SQS. (splunk.github.io) CloudTrail is Amazon Web Services’ record of account activity, including console, software development kit, and command-line API calls. VPC Flow Logs capture Internet Protocol traffic to and from network interfaces inside a virtual private cloud. (docs.aws.amazon.com 1) (docs.aws.amazon.com 2) The Splunk Add-on for AWS already supports collecting CloudTrail events from an Amazon Simple Queue Service queue that subscribes to notifications, and Splunk says one CloudTrail input can read from a centralized Amazon Simple Storage Service bucket for all regions. (splunk.github.io) Terraform is HashiCorp’s infrastructure-as-code tool, which means the lab can define queues, buckets, and permissions in versioned configuration files instead of manual setup steps. Amazon says SQS is a managed queue for moving messages between components, which is the piece that carries log notifications into the ingestion pipeline. (developer.hashicorp.com) (docs.aws.amazon.com) The detection example centers on identity abuse in AWS Identity and Access Management, the permissions system that controls who can do what in an account. AWS says CloudTrail logs IAM API calls, and three of the actions highlighted in the lab — `CreateUser`, `AttachUserPolicy`, and `CreateAccessKey` — map to creating a user, granting permissions, and issuing credentials. (docs.aws.amazon.com 1) (docs.aws.amazon.com 2) Splunk’s own AWS IAM privilege-escalation analytics story groups CloudTrail detections around the same problem: attackers chaining weak permissions into broader access. Its published detections include AWS CreateAccessKey and other IAM escalation patterns built on `aws:cloudtrail` data. (research.splunk.com 1) (research.splunk.com 2) That makes the lab useful beyond a demo environment. A managed security team onboarding several AWS clients can reuse the same Terraform pattern to stand up log collection quickly, then tune separate Splunk Processing Language searches and alerts per tenant instead of rebuilding the plumbing each time. (developer.hashicorp.com) (splunk.github.io) The timing also fits a broader shift in cloud response work: investigators want repeatable labs that mirror production telemetry without waiting for a full enterprise rollout. GitHub projects such as `ilumenix/dfir-lab` and `briwandt/aws-cloudtrail-detection-lab` show the same demand for low-cost AWS detection environments built around Terraform and CloudTrail. (github.com) (github.com) For defenders, the practical value is simple: get the audit trail, get the network trail, and codify the setup. Once those pieces are in place, the hard part shifts from collecting AWS events to deciding which `CreateUser`, `AttachUserPolicy`, and `CreateAccessKey` sequences deserve an alert. (docs.aws.amazon.com) (research.splunk.com)
