CloudTrail logs show no potential enumeration activity

Check ID: cloudtrail_threat_detection_enumeration
Provider: AWS
Service: cloudtrail
Severity: CRITICAL
Categories: threat-detection
Resource type: AwsCloudTrailTrail

What this check verifies

CloudTrail activity is analyzed for AWS identities executing a broad mix of discovery APIs like List*, Describe*, and Get* within a recent time window. An identity exceeding a configurable ratio of these actions indicates potential enumeration behavior by that principal.

Risk

Concentrated discovery activity signals reconnaissance with valid credentials. Adversaries can map assets and policies to enable privilege escalation, target data stores for exfiltration (confidentiality), and identify services to disrupt (availability), supporting stealthy lateral movement.

Recommendation

Apply least privilege to limit List*/Describe*/Get* to necessary resources and roles; use separation of duties.

Enforce MFA and short-lived sessions
Use SCPs to curb unnecessary discovery
Baseline expected reads and alert on spikes as defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws iam update-access-key —user-name <USER_NAME> —access-key-id <ACCESS_KEY_ID> —status Inactive

# Deny common enumeration APIs for a specific IAM user
resource "aws_iam_user_policy" "<example_resource_name>" {
  name = "deny-enumeration"
  user = "<example_user_name>"

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Effect   = "Deny", # CRITICAL: blocks typical enumeration calls
      Action   = [
        "ec2:Describe*",   # CRITICAL
        "iam:List*",       # CRITICAL
        "s3:List*",        # CRITICAL
        "s3:Get*"          # CRITICAL
      ],
      Resource = "*"
    }]
  })
}

# CloudFormation: deny common enumeration APIs for a specific IAM user
Resources:
  DenyEnumerationPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: deny-enumeration
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Deny  # CRITICAL: blocks typical enumeration calls
            Action:
              - ec2:Describe*   # CRITICAL: deny EC2 describe APIs
              - iam:List*       # CRITICAL: deny IAM list APIs
              - s3:List*        # CRITICAL: deny S3 list APIs
              - s3:Get*         # CRITICAL: deny S3 get APIs (e.g., GetBucketAcl)
            Resource: "*"
      Users:
        - "<example_resource_name>"  # CRITICAL: target the enumerating user

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudtrail_threat_detection_enumeration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CloudTrail records S3 object-level write events No potential LLM jacking activity detected in CloudTrail

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires