In today's cloud-based infrastructure, AWS IAM (Identity and Access Management) is one of the most critical components for ensuring security. However, despite the many safeguards in place, IAM-related incidents can occur, ranging from simple misconfigurations to full-blown attacks. In this talk, we will discuss how to perform forensics and incident response for AWS IAM. We will cover the tools and techniques necessary to investigate and identify root causes of IAM incidents. We will also discuss how to mitigate and remediate incidents, as well as how to implement proactive measures to prevent future incidents. By the end of this talk, attendees will have a better understanding of how to effectively handle AWS IAM-related incidents and ensure the security of their AWS environments.

1. AWS IAM Forensics &
Incident Response
Cado Security | 1

2. What is AWS IAM?
https://blog.gitguardian.com/aws-iam-security-best-practices/

3. What are Policies?

4. How does IAM Work
Under the Hood?

5. What is Identity Federation?
“How to Establish Federated Access to Your AWS Resources by Using Active Directory
User Attributes” - AWS.com

6. What AWS IAM Logging is there?
https://docs.aws.amazon.com/IAM/latest/UserGuide/security-logging-and-monitoring.html
AWS CloudTrail captures all API calls for IAM and AWS STS as events, including
calls from the console and API calls.
AWS Identity and Access Management Access Analyzer helps you identify the
resources in your organization and accounts, such as Amazon S3 buckets or IAM
roles, that are shared with an external entity. This helps you identify unintended
access to your resources and data, which is a security risk.

7. Cado Response
Free 14-day trial
Receive unlimited access to
the Cado Response Platform
for 14 days.
www.cadosecurity.com/free-investigation/