/conducting-cloud-incident-response

name: conducting-cloud-incident-response
description: Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure. Use when CSPM alerts or audit logs show compromised cloud credentials, unauthorized IAM changes, or a breach spanning cloud services.
domain: cybersecurity
subdomain: incident-response
tags:
- cloud-IR
- AWS-forensics
- Azure-incident-response
- GCP-security
- identity-containment
mitre_attack:
- T1078
- T1537
- T1580
- T1525
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Conducting Cloud Incident Response

When to Use

• Cloud security posture management (CSPM) alerts on unauthorized resource changes
• CloudTrail, Azure Activity Logs, or GCP Audit Logs show suspicious API calls
• Cloud access keys or service principal credentials are suspected compromised
• Unauthorized compute instances, storage buckets, or IAM changes are detected
• A cloud-hosted application is breached and attacker activity spans cloud services

**Do not use** for on-premises-only incidents with no cloud component; use standard enterprise IR procedures.

Prerequisites

• Cloud-native logging enabled and centralized: AWS CloudTrail (all regions), Azure Activity/Sign-in Logs, GCP Cloud Audit Logs
• IR-specific cloud IAM roles pre-provisioned with read-only forensic access
• Isolated forensic account/subscription/project for evidence preservation
• Cloud incident response runbooks specific to each cloud provider
• Cloud-native security tools: AWS GuardDuty, Azure Defender for Cloud, GCP Security Command Center
• Network traffic logging: VPC Flow Logs (AWS/GCP), NSG Flow Logs (Azure)

Workflow

Step 1: Detect and Confirm the Cloud Incident

Identify the scope and nature of the compromise:

**AWS Indicators:**

CloudTrail suspicious events to investigate:
- ConsoleLogin from unexpected geolocation or IP
- CreateAccessKey for existing IAM user (persistence)
- RunInstances for crypto-mining (large instance types)
- PutBucketPolicy making S3 bucket public
- AssumeRole to cross-account roles
- DeleteTrail or StopLogging (defense evasion)
- CreateUser or AttachUserPolicy (privilege escalation)

**Azure Indicators:**

Azure Activity Log events to investigate:
- Sign-in from anonymous IP or TOR exit node
- Service principal credential added
- Role assignment changes (Owner, Contributor added)
- VM created in unusual region
- Storage account access key regenerated
- Conditional Access policy modified or deleted
- MFA disabled for user account

**GCP Indicators:**

GCP Audit Log events to investigate:
- SetIamPolicy changes granting broad access
- CreateServiceAccountKey for existing SA
- InsertInstance in unexpected zone
- SetBucketIamPolicy with allUsers
- DeleteLog or UpdateSink (log tampering)

Step 2: Contain Cloud Identity Compromise

Cloud containment is primarily an identity operation:

**AWS Containment:**

# Disable compromised IAM access keys
aws iam update-access-key --user-name compromised-user \
  --access-key-id AKIA... --status Inactive

# Attach deny-all policy to compromised user
aws iam attach-user-policy --user-name compromised-user \
  --policy-arn arn:aws:iam::aws:policy/AWSDenyAll

# Revoke all active sessions for compromised IAM role
aws iam put-role-policy --role-name compromised-role \
  --policy-name RevokeOlderSessions --policy-document '{
    "Version":"2012-10-17",
    "Statement":[{
      "Effect":"Deny",
      "Action":"*",
      "Resource":"*",
      "Condition":{"DateLessThan":
        {"aws:TokenIssueTime":"2025-11-15T15:00:00Z"}}
    }]
  }'

# Isolate compromised EC2 instance
aws ec2 modify-instance-attribute --instance-id i-0abc123 \
  --groups sg-isolate-forensic

**Azure Containment:**

# Disable compromised user
Set-AzureADUser -ObjectId "user@tenant.onmicrosoft.com" -AccountEnabled $false

# Revoke all sessions
Revoke-AzureADUserAllRefreshToken -ObjectId "user-object-id"

# Remove role assignments
Remove-AzRoleAssignment -ObjectId "sp-object-id" -RoleDefinitionName "Contributor"

# Isolate VM with NSG deny-all rule
$nsg = New-AzNetworkSecurityGroup -Name "isolate-nsg" -ResourceGroupName "rg" -Location "eastus"
$nsg | Add-AzNetworkSecurityRuleConfig -Name "DenyAll" -Priority 100 -Direction Inbound `
  -Access Deny -Protocol * -SourceAddressPrefix * -SourcePortRange * `
  -DestinationAddressPrefix * -DestinationPortRange *

Step 3: Preserve Cloud Evidence

Collect evidence before ephemeral resources are terminated or logs rotate:

**AWS Evidence Collection:**

• Export CloudTrail events to S3 in the forensic account
• Snapshot EBS volumes of compromised EC2 instances
• Copy S3 access logs and object versions
• Export VPC Flow Logs for the affected VPC
• Capture IAM credential reports and access advisor data

**Azure Evidence Collection:**

• Export Azure Activity Logs and Sign-in Logs (90-day retention by default)
• Snapshot managed disks of compromised VMs
• Export Azure AD audit logs
• Capture NSG flow logs
• Export Conditional Access sign-in details

**GCP Evidence Collection:**

• Export Cloud Audit Logs to a forensic storage bucket
• Snapshot persistent disks of compromised VMs
• Export VPC Flow Logs
• Capture IAM policy snapshots

Step 4: Investigate Cloud-Specific Attack Patterns

Analyze logs for common cloud attack techniques:

Common Cloud Attack Patterns:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Credential Compromise → IAM Privilege Escalation → Resource Abuse
2. Public S3/Blob → Data Exfiltration
3. SSRF from Web App → IMDS Token Theft → Lateral Movement
4. Compromised CI/CD Pipeline → Malicious Deployment
5. Cross-Account Role Abuse → Multi-Account Pivot
6. Lambda/Function Abuse → Crypto-mining or Data Processing

**IMDS Token Theft