AWS CloudTrail: Anatomy of an Incident

Demo Curator's Workspace · CC BY-SA 4.0 · Published Sep 27, 2026

Open embed

A single morning of AWS API activity reconstructed from CloudTrail — from a routine console sign-in to an attacker minting an access key, escalating IAM privileges and pulling S3 objects, with GuardDuty and AWS Config catching up minutes later. All times UTC.