Inspect usage — log analysis and the timeline that survives the audit

The use-window audit is the step that distinguishes exposure from compromise. The audit log query asks a single question: between commit time and disable time, did the leaked credential make any API call? The answer determines whether the response ends with a history rewrite or extends to a forensic review of every resource the credential could reach.

The audit log query

For each cloud provider, the filter is the credential fingerprint:

flowchart LR
    A["credential disabled"] --> C["audit log query"]
    B["commit time"] --> C
    C --> D["events in window"]
    D --> E["expected calls"]
    D --> F["unexpected calls"]
    E --> G["timeline"]
    F --> G
    G --> H["indicators of compromise"]
    H --> I["exposure class"]
    H --> J["compromise class"]

• AWS. CloudTrail, filtered by access key ID.
• GCP. Cloud Audit Logs, filtered by service account email.
• Azure. Activity Log, filtered by service principal.
• GitHub. Audit log, filtered by user or PAT.

Distinguishing expected from unexpected

Each API call has three attributes:

• Caller. The system or user. For a legitimate credential, the caller is one of the consumers from the scope step.
• Action. Read (s3:GetObject) is lower risk than write (s3:DeleteObject) and far lower than privilege (iam:AttachUserPolicy).
• Source IP. In the team’s egress range for a legitimate consumer; unfamiliar for an attacker.

Expected calls come from a known consumer, a known IP, with an action consistent with the consumer’s role. Anything else is unexpected.

The timeline artefact

The timeline is a chronological list of every event that matters to the audit. Six columns: timestamp (incident clock, to the minute), event (alert received, scope confirmed, credential disabled, rotated, consumer updated, revoked, audit query executed, call logged, indicator identified), operator, source system, reference (credential fingerprint, API call ID, commit SHA), and free-form notes.

Indicators of compromise

The indicators are a list, not a threshold:

• Calls from an unfamiliar IP. Outside the team’s egress range.
• Calls to high-risk actions. iam:CreateAccessKey, iam:AttachUserPolicy, kms:Decrypt, s3:DeleteObject.
• Calls to unfamiliar regions. Outside the team’s operating regions.
• Console logins. Any login by the credential.

Closing the use-window review

The review closes when every API call has been attributed or flagged, the indicators list has been triaged by the incident commander, and the timeline has been finalised. Zero indicators is exposure-only; any indicator is compromise.

Production discipline

1. Query the audit log directly. The SIEM is a cache; the audit log is the canonical record.
2. Attribute every call. Caller, action, IP.
3. The timeline is the artefact. Chat messages without a timeline produce no audit artefact.

Cross-course references

• Linux for Production Sysadmins - Part XXX (AuditAndLog) covers the audit log patterns.
• Ansible for Production Sysadmins - Part XXXVII (RepoArch) covers the audit trail patterns.
• Terraform for Production Sysadmins - Part XV (CredentialRotation) covers the rotation patterns.

Quiz