Summary

In this chapter, we covered setting up a CloudTrail Event that follows best practices where possible, and also how to audit for the best practices in a target environment. CloudTrail is not a perfect service, and we have demonstrated that through the use of services that it does not support it is possible to perform reconnaissance in an account without ever generating any logs. For this reason, it is useful to keep track of what services are unsupported in CloudTrail so that you can exploit them as they are released while in a target environment, without every showing up in the logs. Cross-account enumeration methods also allow us to discover information about our target account without generating logs (in the target account), meaning that we can get an understanding of who uses the environment and what is used in the environment without making API calls with the compromised...