Using Amazon Detective for IAM investigations

This article provides a guide on using Amazon Detective for investigating IAM users and roles involved in security events. It covers:

• Prerequisites for following along
• Scenario 1: Automated investigations using the Detective console and API to initiate investigations and view details on impacted IAM entities
• Scenario 2: An investigator persona using Detective to analyze the impact of a GuardDuty finding involving an IAM user/role
• Scenario 3: A threat hunter persona using Detective to identify IAM entities communicating with suspicious IP addresses
• Conclusion highlighting the new IAM investigation capability in Detective for automatically detecting compromised IAM entities