Master cloud forensic log analysis. This simulation challenges you to pinpoint the exact JSON fields inside AWS CloudTrail records to attribute unauthorized resource creation to specific compromised identities.

CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

During an incident response engagement for a FinTech startup, the security team detected anomalous compute billing spikes in the AWS us-east-1 region. Several expensive EC2 instances (c5.24xlarge) were deployed outside of standard CI/CD pipelines, strongly indicating a crypto-jacking compromise.

Forensics investigators have acquired the relevant AWS CloudTrail log archives from the organization's dedicated security logging account to trace the origin of the unauthorized API calls and identify the compromised credentials.

Evidence Collected

[+] CLOUDTRAIL LOG ENTRY EXTRACT File: 123456789012_CloudTrail_us-east-1_20260409T0825Z_x1y2z3.json.gz Verification Hash (SHA256): 8c14f6b0b2e3d7a8c4f9a1e0b5d6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4 { "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAJ45Q7Y6EZHEXAMPLE", "arn": "arn:aws:iam::123456789012:user/dev-admin-jdoe", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "dev-admin-jdoe" }, "eventTime": "2026-04-09T08:23:41Z", "eventSource": "ec2.amazonaws.com", "eventName": "RunInstances", "awsRegion": "us-east-1", "sourceIPAddress": "198.51.100.42", "userAgent": "aws-cli/2.15.0 Python/3.11.6 Linux/5.15.0-1044-aws", "requestParameters": { "instanceType": "c5.24xlarge", "imageId": "ami-0c55b159cbfafe1f0", "minCount": 5, "maxCount": 5 } }

Question

In a cloud-forensics case involving AWS, an investigator needs to identify which IAM user created a new EC2 instance. Which field in the CloudTrail log entry for the "RunInstances" event contains this information?

Correct. The userIdentity element contains details about the principal that made the request. In cloud forensics, this is the primary field analyzed to extract the IAM user name, AWS Account ID, access key ID, and ARN responsible for an action.

Incorrect. The eventSource field identifies the specific AWS service that the request was made to (e.g., ec2.amazonaws.com). It does not provide any information regarding the identity of the user initiating the action.

Incorrect. The responseElements field logs the response provided by the AWS service after executing the API call (such as the generated instanceId of the newly spun-up EC2). It does not contain the identity of the requester.

Incorrect. The requestParameters field logs the parameters sent in the API request payload, such as the instanceType or imageId (AMI) requested. It dictates *what* is being built, not *who* is building it.

Forensic Hint: Review the provided JSON evidence snippet. Look for the top-level object key that directly nests the "userName", "type", and "accessKeyId" attributes.

Expert Analysis

1. What the Evidence Shows

The CloudTrail log clearly records a RunInstances event executed by an IAM User named dev-admin-jdoe using the access key AKIAIOSFODNN7EXAMPLE. The request originated from an external IP (198.51.100.42) to spin up five heavy-compute (c5.24xlarge) resources.

2. Forensic Stage

This task is part of the Analysis phase, specifically focusing on Cloud Environments and Log Correlation.

3. Why the Correct Answer is Correct

A. userIdentity: In AWS CloudTrail architecture, identity attribution is strictly maintained within the userIdentity JSON block. Whether the actor is a root user, an IAM user, an assumed role (STS), or an AWS service, this block holds the principal ID, ARN, and credentials utilized, establishing the digital equivalent of a "suspect profile" in cloud investigations.

4. Why Others are Wrong

eventSource: Only dictates the receiving API endpoint (e.g., EC2, S3, IAM).
responseElements: Provides post-execution state data (e.g., the IDs of the created instances).
requestParameters: Details the technical specifics of the request (size, count, subnets).

5. Real-World Forensic Action

Upon identifying the compromised identity within userIdentity, a forensic investigator would execute a timeline analysis filtering CloudTrail logs by that specific accessKeyId or arn. The immediate incident response action would be to revoke the access key, attach an explicit "Deny All" policy to the user, and search for potential persistence mechanisms (e.g., creating new IAM users) executed by that identity.

6. MINI LESSON: Cloud Chain of Custody

In cloud forensics, investigators cannot physically seize a server. Logs are the primary evidence. To maintain the Chain of Custody and ensure non-repudiation, CloudTrail logs should always be stored in an isolated, restricted S3 bucket in a separate AWS Account, with Multi-Factor Authentication (MFA) Delete enabled and CloudTrail Log File Validation turned on. This proves mathematically (via SHA-256) that the JSON logs have not been tampered with since AWS wrote them.

Ready for the next investigation?

Enhance your digital forensics expertise with full-length CHFI practice scenarios.

Explore more CHFI simulations