Although CloudTrail is meant to be the central logging source for an AWS account, the way that it is built leaves some undesirable risks out in the open as new AWS services are being developed. The team working at AWS that is creating a new service must create the CloudTrail integration with their service to allow its API calls to be logged to CloudTrail. Also, because of how fast AWS pushes out new services and functionality, there are many services that get released without any support for CloudTrail. That list can be found here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-unsupported-aws-services.html. Later in this chapter, we will dive into abusing unsupported services for our advantage as an attacker, as any API call that doesn't get logged to CloudTrail can do wonders for us as attackers.
CloudTrail is also not the only...
