We will now be switching gears to cover how CloudTrail can help us out as an attacker. One of the ways it can help us is with reconnaissance and information gathering.
You might not always be able to compromise a user who has the necessary S3 read permissions and has access to encrypt the data with the KMS key used originally. If you don't have both of those permissions, then you won't be able to read the log files. There might even be other restrictions in place that make it difficult for you. To get around this, we can use our cloudtrail:LookupEvents permission to interact with the CloudTrail Event history. The CloudTrail Event history is an always-on, immutable record of read/write management events that is made available through the CloudTrail API. These logs can be fetched by using the LookupEvents API or by visiting the Event history page in the...
