Amazon Web Services (AWS) Reports

S. No	Report Title	Details Provided
1	User login activity	Recent logins and failed logins Login activity based on IP address, users and geographical region
2	Failed / Unauthorised activity	Error events that have occurred Recent login and authorization failures that have taken place
3	IAM activity	Occurrence of IAM errors, user activities and unauthorized activities Recently created/deleted users, roles and groups Password changes. Users who have been recently added to groups Creation and deletion of MFA devices Virtual MFA devices that have been enabled and deactivated Access keys that have been created, deleted and updated Status of various IAM user credentials
4	User activity	Recent user activity Creation, deletion and update of resources by users Unsuccessful events by users
5	Network Security Groups (NSG)	Creation and deletion of security groups Changes made to security group configuration Recently revoked security group ingress and egress Recently authorized security group ingress and egress Network ACL and gateway changes made
6	Virtual Private Cloud (VPC)	Creation and deletion of customer gateways Recently created, deleted, attached or detached internet gateways and VPN gateways VPC endpoints that have been created, modified and deleted. Route table that have been created, deleted, associated and dissociated Routes that have been created, deleted and replaced Subnets that have been created and deleted Associated and dissociated subnet CIDR blocks
7	Web Application Firewall (WAF)	WAF error events that have occurred The recently created, deleted and updated WAF rules IP sets Byte match sets Constraint sets Injection match sets Xss match sets Web ACLs Recently associated and dissociated web ACLs
8	Elastic IP address	Elastic IP addresses that have recently been allocated, released, associated and dissociated IP addresses that have recently been moved to VPC IP addresses that have recently been restored to Classic
9	Elastic Network Interface	IPv6 addresses and private IP addresses that have been assigned and unassigned Network interfaces that have been recently created, deleted, attached and detached Modification and resetting of network interface attributes
10	Security Token Service	Events caused by STS errors The below requests made: Overall AssumeRole requests AssumeRole with SAML requests AssumeRole with WebIdentity requests Decode authorization message requests Get caller identity requests Get federation token requests Get session token requests
11	Key Pairs activity	Recently created, deleted and imported key pairs
12	AWS Config	AWS Config errors that have occurred The addition and deletion of AWS Config rules Configuration recorders Delivery channels Deleted evaluation results Configuration recorders that have been started and stopped
13	Amazon Auto Scaling	Auto Scaling error events Creation and deletion of Launch configurations Auto scaling groups Scaling policies Modified Auto Scaling groups Attached and detached Auto Scaling instances Attached and detached Load balancers
14	Amazon Elastic Load Balancing (ELB)	Auto Scaling error events Creation and deletion of Launch configurations Auto scaling groups Scaling policies Modified Auto Scaling groups Attached and detached Auto Scaling instances Attached and detached Load balancers
15	Amazon Relational Database Service (RDS)	RDS error events Created and deleted RDS instances Roles recently added to DB clusters Tags recently added to RDS resources Authorized and revoked DB security group ingress Created and deleted DB security groups DB snapshots that have been created, deleted and updated DB clusters that are created, deleted and restored Restored DB instances
16	S3 Bucket activity	Overall S3 activity Buckets created and deleted Failed actions in S3
17	S3 traffic analysis	The overall S3 traffic All S3 requests made Requests based on Remote IP, Operation and HTTP status Failed requests based on error code Requests with error access
18	Route 53	Overall Route 53 activity Failed events in Route 53 Hosted zones that have been recently created and deleted Configuration changes made to private hosted zones Recent reusable delegation set activity Modified resource record sets Traffic policy configuration changes Traffic policy instance configuration changes Domain configuration changes