Cloud Forensics
Incident ResponseCloud Forensics is the process of collecting and analyzing evidence from cloud resources after a security incident. Unlike traditional forensics, cloud forensics works with API logs, metadata, and snapshots rather than physical hardware.
AWS Evidence Sources
- CloudTrail: who did what, when, from where (API calls)
- VPC Flow Logs: network traffic metadata (source, destination, ports, bytes)
- EBS snapshots: point-in-time disk images for offline analysis
- Memory dumps: using SSM to capture running memory from EC2 instances
- S3 access logs: who accessed which objects
- GuardDuty findings: correlated threat intelligence
Related AWS Services
Related Terms
The structured process of detecting, containing, eradicating, and recovering from a security incident, following frameworks like NIST SP 800-61.
The incident response phase where you isolate affected resources to prevent the threat from spreading - deactivating keys, quarantining instances, blocking network access.
AWS service that records every API call made in your account, providing an audit trail of who did what, when, and from where.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.