View a markdown version of this page

DSSEC04-BP03 Establish comprehensive logging and monitoring of operator actions - Digital Sovereignty Lens
Implementation guidanceResources

DSSEC04-BP03 Establish comprehensive logging and monitoring of operator actions

Enable detailed logging to track operator actions, detect unauthorized access, and retain evidence required for audits. Detailed audit trails provide visibility into change management activities and operator-led actions. This is particularly important for workloads with sovereignty requirements, where you may need to locate operational support teams within specific jurisdictions, strictly control operator actions, and produce documentary evidence of technical and operational controls.

Desired outcome:

  • Organizations maintain visibility into operator actions and system changes with detailed audit trails for compliance and security investigations.

  • Immutable, tamper-evident logs of system changes are preserved and stored within approved jurisdictions for audit and troubleshooting purposes.

Common anti-patterns:

  • Failing to detect or alert on unauthorized operator actions.

  • Not enabling logging consistently across AWS services, Regions, and accounts, resulting in visibility gaps.

  • Storing sensitive log data without proper encryption, access controls, or immutable storage mechanisms.

  • Implementing inconsistent logging formats, standards, or retention periods across services and environments.

Benefits of establishing this best practice:

  • Visibility into operator activities with early detection of unauthorized or suspicious activities.

  • Tracks data access patterns, supports data protection initiatives, and enables verification of compliance with data localization mandates, and data residency requirements.

  • Automated log collection and demonstrable evidence of effective security controls to auditors and stakeholders.

  • Detailed audit trails and forensic evidence enable faster investigation and event reconstruction. Detailed session logs and activity tracking improve troubleshooting capabilities.

Level of risk exposed if this best practice is not established: High

Implementation guidance

Begin by understanding the support activities performed, and the network routes used by your operational support teams. Mature operational support teams will have a catalog of runbooks they execute for common activities such as taking backups, applying patches, or rotating credentials.

For each runbook, identify the systems accessed, the level of privilege required, the network path taken, and the geographic location from which the activity originates. Then document the following:

  • Specific logging requirements based on your industry and jurisdictional regulations.

  • Retention periods for different types of logs.

  • Data localization or data residency constraints for log storage.

  • The information required to be recorded in each individual log entry for each type of log output.

  • Critical systems and data that require enhanced logging.

SEC04-BP01 Configure service and application logging, and SEC04-BP02 Capture logs, findings, and metrics in standardized locations provide a solid foundation to build on. Review additional capabilities that may be required to fulfill digital sovereignty requirements. Key implementation considerations include:

  • Access monitoring: Monitoring and logging of operator actions performed.

  • Log storage: Log aggregation and log storage including retention periods, costs, and formats identified in your requirements.

  • Log sharing: Sharing operator access logs securely with external organizations such as named auditors, investigative agencies, or other bodies appointed by regulators.

  • Alerting: Detecting, logging, and alerting on deviations from baselines.

Verify logs are stored within approved jurisdictions and comply with data residency requirements. Implement encryption using cryptographic keys managed within sovereign boundaries. Maintain audit trails that demonstrate adherence to local data protection and privacy laws. Configure cross-border log transfer as required by regulatory frameworks.

Implementation steps

  1. Enable AWS CloudTrail across Regions and accounts: Record operator actions by enabling organization-wide logging.

    • Enable organization-wide AWS CloudTrail trails that capture read and write management operations that are performed on resources across your AWS accounts. If you have created an organization in AWS Organizations, you can create an organizational trail that logs all events for all AWS accounts in that organization. Management operations are also referred to as control plane operations.

    • By default, trails and event data stores don't log data events. To record data plane operations you can enable CloudTrail data event logs for Amazon S3 object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations), Amazon Bedrock (for example API activity on models), and Amazon SNS. See list of data events supported by AWS CloudTrail. These logs assist in the detection of unauthorized operator access to sensitive data. Also see Logging data events for AWS Config compliance which lists logging best practices and how they relate to compliance frameworks. Data events are high volume. To control costs you can filter trails using advanced event selectors.

    An organization trail is a multi-Region trail and will log events from all AWS Regions enabled in your account, with all log files delivered to a single S3 bucket in your home Region. Make sure that the destination Region is acceptable under your data residency policy.

  2. Protect logs: Protect the integrity and confidentiality of your log data to maintain a trustworthy chain of evidence for auditors and regulators.

  3. Establish operator identity: When operators assume a role through the AWS Security Token Service (AWS STS), to perform actions on resources, CloudTrail logs the IAM role that made the call and not the identity of the user who may have assumed that role. This can make it challenging for administrators to trace which identity was responsible for actions performed. To address this, with AWS STS you can set a unique attribute called SourceIdentity, which helps you see which identity is responsible for a given action. Refer to this blog post How to integrate AWS STS SourceIdentity with your identity provider to see how this works in practice.

    After you configure your IDP, and add the sts:SetSourceIdentity permission to your IAM role's trust policy, CloudTrail will start logging the sourceIdentity when an operator makes an API call using that IAM role. For example, for a CreateBucket event, CloudTrail will log the source identity as shown here (and as illustrated in the blog post).

    Note

    The code snippets shown here are for illustration only and may not be accurate. Validate against your own environment and requirements unique to your workload. 

    
{
"eventVersion": "1.08",
"userIdentity": {
    "type": "AssumedRole",
    "principalId": "AAAAAAAAAAAAAAAAAAAAA:sourceidentitytest",
    "arn": "arn:aws:sts::111122223333:assumed-role/idsol-org-admin/sourceidentitytest",
    "accountId": "111122223333",
    "accessKeyId": "XXXXXXXXXXXXXXX",
    "sessionContext": {
    "sessionIssuer": {
        "type": "Role",
        "principalId": "AAAAAAAAAAAAAAAAAAAAA",
        "arn": "arn:aws:iam::111122223333:role/idsol-org-admin",
        "accountId": "111122223333",
        "userName": "idsol-org-admin"
    },
    "webIdFederationData": {},
    "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-05-05T16:29:19Z"
    },
    "sourceIdentity": "<sourceidentitytest@example.com>"
    }
},
"eventTime": "2021-05-05T16:33:25Z",
"eventSource": "s3.amazonaws.com",
"eventName": "CreateBucket",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.0"
}

  4. Implement session logging: One-time operator access through terminal emulators should not be the norm. However, such sessions may need to be temporarily allowed for troubleshooting or during incidents. We recommend using AWS Systems Manager Session Manager as it provides secure node management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager provides you with the ability to log session activity in your AWS account using AWS CloudTrail. See options available under enabling and disabling session logging.

  5. Configure monitoring and alerting:

  6. Verify logging completeness and compliance:

    • Regularly audit logging configurations against requirements. Perform periodic testing to verify logs capture critical activities (such as IAM policy changes, S3 bucket deletions, or security group modifications).

    • Conduct simulated security incidents to test the effectiveness of your logging configurations. Consider using AWS Well-Architected Labs - Security for hands-on practice.

  7. Validate third-party controls: Organizations often use third-party services that generate, process, or consume security and compliance data (such as APM SaaS providers, SIEM systems, or compliance management solutions). To verify that these services meet the same operator access logging standards:

    • Request relevant accreditations or certifications specific to the services they provide (such as SOC 2, ISO 27001, or Region-specific certifications).

    • Verify the data residency of the service and confirm it meets your sovereignty requirements.

    • Perform independent security assessments of third-party integrations.

    • Use AWS PrivateLink for third-party connectivity to block data exfiltration through the public internet. Don't share raw CloudTrail logs with third parties; use aggregated or anonymized data where possible.

  8. Implement continuous improvement:

    • Regularly review and update your logging strategy based on regulatory changes and emerging threats.

    • Assess new AWS services for logging requirements as you adopt them.

    • Incorporate feedback from security teams, auditors, and incident response exercises.

    • Conduct regular training on log analysis techniques using resources like AWS Skill Builder and AWS Security workshops.

Resources

Related best practices:

Related documents:

Related videos:

Related examples:

Related services: