Question

A financial services company must detect and respond to any AWS Management Console sign-in using the root user account within their production account. When a root login occurs, the security team requires immediate paging notification AND an automatic audit record captured for compliance. The team wants a fully event-driven solution with no polling and the least operational overhead. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching CloudTrail 'ConsoleLogin' events where userIdentity.type is 'Root', targeting an SNS topic subscribed to PagerDuty and a Lambda function that writes an audit record to a compliance DynamoDB table.

Answer

Enable AWS Config with a managed rule that checks for root account usage, and configure a remediation action that publishes to an SNS topic when the rule is non-compliant.

Answer

Create a CloudWatch metric filter on the CloudTrail log group that matches root console logins, then create a CloudWatch alarm that notifies an SNS topic when the metric exceeds zero.

Answer

Schedule a Lambda function every 5 minutes via EventBridge Scheduler to query CloudTrail Lookup for root ConsoleLogin events and send an SNS notification if any are found.