| name | conducting-cloud-incident-response |
| description | Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["cloud-IR","AWS-forensics","Azure-incident-response","GCP-security","identity-containment"] |
| mitre_attack | ["T1078","T1537","T1580","T1525"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Conducting Cloud Incident Response
When to Use
- Cloud security posture management (CSPM) alerts on unauthorized resource changes
- CloudTrail, Azure Activity Logs, or GCP Audit Logs show suspicious API calls
- Cloud access keys or service principal credentials are suspected compromised
- Unauthorized compute instances, storage buckets, or IAM changes are detected
- A cloud-hosted application is breached and attacker activity spans cloud services
Do not use for on-premises-only incidents with no cloud component; use standard enterprise IR procedures.
Prerequisites
- Cloud-native logging enabled and centralized: AWS CloudTrail (all regions), Azure Activity/Sign-in Logs, GCP Cloud Audit Logs
- IR-specific cloud IAM roles pre-provisioned with read-only forensic access
- Isolated forensic account/subscription/project for evidence preservation
- Cloud incident response runbooks specific to each cloud provider
- Cloud-native security tools: AWS GuardDuty, Azure Defender for Cloud, GCP Security Command Center
- Network traffic logging: VPC Flow Logs (AWS/GCP), NSG Flow Logs (Azure)
Workflow
Step 1: Detect and Confirm the Cloud Incident
Identify the scope and nature of the compromise:
AWS Indicators:
CloudTrail suspicious events to investigate:
- ConsoleLogin from unexpected geolocation or IP
- CreateAccessKey for existing IAM user (persistence)
- RunInstances for crypto-mining (large instance types)
- PutBucketPolicy making S3 bucket public
- AssumeRole to cross-account roles
- DeleteTrail or StopLogging (defense evasion)
- CreateUser or AttachUserPolicy (privilege escalation)
Azure Indicators:
Azure Activity Log events to investigate:
- Sign-in from anonymous IP or TOR exit node
- Service principal credential added
- Role assignment changes (Owner, Contributor added)
- VM created in unusual region
- Storage account access key regenerated
- Conditional Access policy modified or deleted
- MFA disabled for user account
GCP Indicators:
GCP Audit Log events to investigate:
- SetIamPolicy changes granting broad access
- CreateServiceAccountKey for existing SA
- InsertInstance in unexpected zone
- SetBucketIamPolicy with allUsers
- DeleteLog or UpdateSink (log tampering)
Step 2: Contain Cloud Identity Compromise
Cloud containment is primarily an identity operation:
AWS Containment:
aws iam update-access-key --user-name compromised-user \
--access-key-id AKIA... --status Inactive
aws iam attach-user-policy --user-name compromised-user \
--policy-arn arn:aws:iam::aws:policy/AWSDenyAll
aws iam put-role-policy --role-name compromised-role \
--policy-name RevokeOlderSessions --policy-document
aws ec2 modify-instance-attribute --instance-id i-0abc123 \
-- sg-isolate-forensic
