CHFI (312-49) Digital Forensics Simulation

In this simulation, you will focus on cloud infrastructure forensics. You will learn how to identify the correct AWS auditing tools required to trace the historical state and configuration of a compromised virtual machine.

Investigation Scenario

During an active incident response engagement, a forensic analyst is investigating an alleged data exfiltration event originating from a Linux-based EC2 instance within an organization's AWS environment. Initial indicators suggest that an attacker compromised a low-privileged web application on the instance and subsequently executed API calls that are normally restricted.

The investigator suspects that an overly permissive IAM profile (Instance Role) was attached to the EC2 instance at the time of the incident, effectively granting the attacker elevated privileges. To build an accurate timeline, the investigator needs to query the historical configuration state of the EC2 instance to prove exactly when the IAM role was assigned and what it looked like during the breach.

Evidence Collected

[+] Target Resource ID: i-0abcd1234efgh5678
[+] Incident Window: 2026-04-09 14:00:00 UTC - 15:00:00 UTC
[+] Suspected IAM Profile: arn:aws:iam::123456789012:role/AdminEscalationRole
[+] Objective: Perform timeline analysis on resource configuration states.

Question

During a cloud-forensics investigation in AWS, an analyst needs to identify which IAM roles have been assigned to an EC2 instance. Which AWS service provides information about the configuration and state of AWS resources over time?

Investigator Hint: Differentiate between API activity logs (who made the call to attach the role) and configuration state logs (what the actual configuration of the EC2 instance looked like at a specific point in time).

Expert Analysis

1. What the Evidence Shows

The forensic objective requires reconstructing a timeline based on the "configuration and state" of a resource. The analyst must view a historical snapshot of the EC2 instance properties, specifically tracking its IAM instance profile association during the incident window.

2. Forensic Stage

Analysis (Timeline & Configuration Review). This phase involves interpreting aggregated log data to establish a chronological sequence of events regarding resource states.

3. Why the Correct Answer is Correct (Option A)

Option A is correct. AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records configuration changes, allowing a forensic investigator to view a timeline of a resource's configuration—including attached IAM roles—at any given point in time.

4. Why Others Are Wrong

Option B: AWS CloudTrail records API calls (e.g., AssociateIamInstanceProfile). While it tells you who made the change and when the API was executed, it does not inherently provide an easy-to-read historical state diagram or the complete configuration baseline of the resource over time.

Option C: Amazon CloudWatch is used for monitoring operational and performance metrics (CPU usage, network throughput) and collecting application logs. It does not track resource configuration metadata.

Option D: VPC Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC. They provide network telemetry, completely unrelated to IAM roles or EC2 resource configuration.

5. Real-World Forensic Action

In a real investigation, an analyst will navigate to the AWS Config console, search for the specific Resource ID (i-0abcd1234efgh5678), and click on "Resource Timeline". This interface visually maps out every configuration change (Configuration Items - CIs) over time. Once the exact timestamp of the IAM role attachment is isolated, the analyst will pivot to AWS CloudTrail using that timestamp to identify the compromised credentials used to initiate the change.

6. MINI LESSON: Cloud Timeline Correlation

• Artifact Interpretation: In traditional forensics, we look at the Registry or file timestamps for state changes. In AWS, AWS Config is the equivalent for tracking the "system state" of your cloud infrastructure.
• Forensic Workflow: A mature cloud investigation workflow requires correlating State with Action. Use AWS Config to find out exactly what changed and when the state was altered. Then, use AWS CloudTrail to find out who performed the action and from where (IP address).

Ready for the next investigation?

Explore more CHFI simulations and master digital forensic techniques.

Explore More CHFI Simulations