Coralogix

Security investigations in AWS frequently stall due to missing log sources rather than lack of skill. Six real-world-inspired scenarios illustrate critical blind spots: missing VPC Flow Logs prevent tracing internal traffic sources during data exfiltration; absent S3 Server Access Logs leave breach scope unknown; disabled EKS audit logs block attribution of rogue pod creation; unconfigured CloudTrail Lambda data events hide direct API abuse; missing CloudWatch Agent OS logs eliminate host-level forensics after SSH compromise; and disabled Route 53 Resolver query logs obscure DNS-based C2 channels. Each scenario maps the specific missing log source to its investigative impact and provides a concrete recommendation. The core takeaway: enable VPC Flow Logs, S3 Server Access Logs, EKS audit logs, CloudTrail data events for Lambda, CloudWatch Agent on EC2, and Route 53 Resolver query logs proactively across all production environments.

The AWS logs you miss during an incident

The “basic logging trifecta” is essential but insufficient

Scenario 1: Missed VPC Flow Logs exposes blind spot in network traffic

Scenario 2: S3 data exfiltration: Which files were stolen?

Scenario 3: Unmasking a rogue pod with EKS Audit Logs

Scenario 4: Tracing serverless abuse with Lambda Invoke Events

Scenario 5: The compromised instance with no host-level footprints

Scenario 6: Detecting C2 Channels with Route 53 Resolver Query Logs