Follow a leaked AWS access key through an AssumeRole escalation chain to scope an S3 data exposure, and learn why partial data-plane logging left a visibility gap
Larkwood Health System, a regional healthcare network, learns through GitHub's secret-scanning partner program that a long-lived AWS access key was committed to a contractor's public repository. Assemble the account's CloudTrail, GuardDuty, CloudWatch, and S3 access-log evidence to trace the intrusion from that leaked key through a misconfigured role trust policy, an IAM policy change that granted standing administrative access, and into two S3 buckets holding patient billing and claims data, then determine the full exposure scope despite an incomplete S3 data-plane logging gap.
Solstice Underwriting's on-call engineer is paged at 3 a.m. by an internal rule for 'unusual AssumeRole activity': an unfamiliar role assumption from a never-before-seen source address, immediately followed by a burst of infrastructure API calls. Reconstruct the CloudTrail identity chain and the role's OIDC trust policy to determine whether this is an intrusion or the account's own GitHub Actions release pipeline running exactly as designed, and name precisely what in the evidence settles it either way.
Bramwell Actuarial's quarterly access review surfaces a console sign-in to an administrative role from an unfamiliar country, 104 days after it happened. CloudTrail Event History has already rolled past it, and the trail's own S3 log bucket carries a lifecycle rule that deleted the delivered log files at the same 90-day mark. Work out exactly what evidence exists, what has permanently aged out, and what a clean CloudTrail query does and does not prove about what happened during that sign-in.
A threat-intel feed flags an EC2 instance at Keswick Freight for a large, sustained outbound transfer to an external address over HTTPS. VPC Flow Logs confirm the connection's volume and timing in exact detail. Work through what flow-log metadata can and cannot tell you about what was actually sent, and identify precisely which additional evidence source would be needed to settle the one question the logs cannot answer.