Proactive Intrusion Detection for Financial Systems with AWS CloudTrail & EventBridge

Background

AWS CloudTrail records every API call made in an AWS account, providing an immutable audit log that can be used for forensic analysis. AWS EventBridge is a server‑less event bus that can ingest CloudTrail events in real time and route them to targets such as Amazon SNS, AWS Lambda, or third‑party incident‑response platforms.

High‑risk events to monitor (red‑line events)

IAM privileged actions

Root account login

Create or delete access keys

Create, modify, or delete IAM users, groups, or roles

Attach high‑privilege policies (e.g., AdministratorAccess)

Disable or delete MFA devices

CloudTrail configuration changes

Stop, delete, or modify a Trail

Infrastructure and network changes

Modify security‑group rules to allow 0.0.0.0/0 on ports such as 22 (SSH) or 3306 (MySQL)

Alter VPC route tables or delete NAT gateways

KMS key operations: DisableKey or

ScheduleKeyDeletion

Example: Detect IAM Access‑Key creation

Prerequisites

CloudTrail must be enabled with a Trail that covers all regions.

Step 1 – Create an SNS topic

In the Amazon SNS console, create a standard topic named security-alerts-topic.

Add an email subscription for the security team and confirm the subscription.

Step 2 – Create an EventBridge rule

Target type: AWS Service Target: the SNS topic created above.

Event source: AWS events or EventBridge partner events AWS service: IAM Event type:

AWS API Call via CloudTrail

Step 3 – Define the event pattern

Paste the following JSON into the Event Pattern editor:

{
  "source": ["aws.iam"],
  "detail-type": ["AWS API Call via CloudTrail"],
  "detail": {
    "eventName": ["CreateAccessKey"]
  }
}

Step 4 – Rule metadata

Name: Detect-IAM-AccessKey-Creation Description: Triggers an alert when a new IAM access key is created.

Event bus:

default

Advanced usage

Severity‑based alert routing

Critical: root login, CloudTrail disabled – route to PagerDuty or OpsGenie.

High: access‑key creation – send email and post to Slack/Teams.

Low: audit‑only events – forward to S3 or a log‑analytics system.

Automated remediation with Lambda

EventBridge detects CreateAccessKey.

A Lambda function is invoked, calls the IAM API to set the newly created key status to Inactive.

The function compiles details (user, key ID) and sends a final alert.

Noise reduction

Exclude legitimate automation (e.g., CI/CD pipelines) by adding a filter on the userIdentity.principalId field. Example filter excludes events where userIdentity.principalId contains CICD-Role.

Conclusion

By combining CloudTrail’s immutable logs with EventBridge’s real‑time routing, security teams can build a proactive intrusion‑detection framework that automatically alerts on high‑risk actions and can trigger immediate remediation via Lambda. The Access‑Key monitoring pattern can be extended to other red‑line events to create a comprehensive, layered defense for critical financial workloads.