Question

A security team wants to detect unusual patterns in API call volume and error rates across their AWS account, such as a sudden spike in IAM policy modifications or an unusual burst of TerminateInstances calls that could indicate compromised credentials. They already have a management events trail enabled but no automated way to surface anomalous behavior. They do not want to build and maintain custom baselining logic or manually tune CloudWatch metric filters for every API. Which approach best meets this requirement with the least operational overhead?

Accepted Answer

Enable CloudTrail Insights events on the existing trail to automatically detect and log unusual write API call rate and error rate activity.

Answer

Create CloudWatch Logs metric filters for every sensitive API action and configure alarms with static thresholds for each one.

Answer

Schedule an Athena query against the CloudTrail S3 bucket every hour and compare call counts against manually maintained baselines.

Answer

Enable CloudTrail data events for all resources and route them to a Lambda function that computes rolling averages of API call rates.