Description

Ensure that AWS CloudTrail trails have CloudTrail Insights enabled for management events, so that CloudTrail automatically analyzes normal API call volume patterns and generates Insights events when unusual activity, such as a spike in error rates or a burst of resource provisioning calls, is detected.

Rationale

Standard CloudTrail logging records every API call but does not, by itself, highlight anomalous patterns of activity; a security team must otherwise manually build detection logic to identify unusual spikes, such as those that might indicate a compromised credential rapidly provisioning resources or a misconfigured automation looping on failed calls. CloudTrail Insights automatically establishes a baseline of normal account activity and surfaces deviations, providing an additional, low-effort detection capability for anomalous API activity.

Impact

  • Provides automated anomaly detection for unusual API call volume or error rate patterns

  • Can help surface early indicators of a compromised credential or misconfigured automation

  • Incurs additional cost per 100,000 events analyzed for Insights

Default Value

CloudTrail Insights is disabled by default on newly created and existing trails.

Pre-Requisites

  • An existing CloudTrail trail with management event logging enabled

  • IAM permissions to update trail Insights configuration (cloudtrail:PutInsightSelectors)

Test Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudTrail > Trails.

  3. Select the trail to review.

  4. Open the Insights events section of the trail configuration.

  5. Verify that Insights events are enabled for API call rate and/or API error rate.

  6. If Insights is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudTrail > Trails and select the trail to update.

  3. Select Edit next to the Insights events section (or under General details).

  4. Enable CloudTrail Insights events, selecting ApiCallRateInsight and/or ApiErrorRateInsight as appropriate.

  5. Save the configuration.

  6. Verify Insights events begin appearing under CloudTrail > Insights after sufficient baseline data has been collected and any anomaly occurs.

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Navigate to AWS CloudTrail > Trails and select the affected trail.

  3. Select Edit next to the Insights events section.

  4. Disable CloudTrail Insights events.

  5. Save the configuration.

Reference