Phần 5: CloudTrail & auditing fundamentals

# 1. S3 bucket cho log (với lifecycle policy)
aws s3api create-bucket --bucket aws-cloudtrail-logs-123456789012 --region ap-southeast-1

# 2. Bucket policy cho CloudTrail
aws s3api put-bucket-policy --bucket aws-cloudtrail-logs-123456789012 --policy '{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"s3:GetBucketAcl","Resource":"arn:aws:s3:::aws-cloudtrail-logs-123456789012"},
    {"Effect":"Allow","Principal":{"Service":"cloudtrail.amazonaws.com"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::aws-cloudtrail-logs-123456789012/AWSLogs/123456789012/*","Condition":{"StringEquals":{"s3:x-amz-acl":"bucket-owner-full-control"}}}
  ]
}'

# 3. Tạo trail: multi-region + global services + log validation + organization
aws cloudtrail create-trail \
  --name org-trail \
  --s3-bucket-name aws-cloudtrail-logs-123456789012 \
  --is-multi-region-trail \
  --include-global-service-events \
  --enable-log-file-validation \
  --is-organization-trail \
  --cloud-watch-logs-log-group-arn arn:aws:logs:ap-southeast-1:123456789012:log-group:cloudtrail:*

aws cloudtrail start-logging --name org-trail

CREATE EXTERNAL TABLE cloudtrail_logs (
  eventVersion STRING,
  userIdentity STRUCT<type:STRING,arn:STRING,userName:STRING>,
  eventTime STRING, eventName STRING, sourceIPAddress STRING,
  userAgent STRING, errorCode STRING, requestParameters STRING
)
PARTITIONED BY (region STRING, year STRING, month STRING, day STRING)
ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
LOCATION 's3://aws-cloudtrail-logs-123456789012/AWSLogs/123456789012/';

-- Ai xóa RDS instance?
SELECT userIdentity.userName, eventTime, sourceIPAddress
FROM cloudtrail_logs WHERE eventName = 'DeleteDBInstance'
  AND year='2026' AND month='06' ORDER BY eventTime DESC;

-- API nào bị deny nhiều nhất? (potential attack scan)
SELECT eventName, COUNT(*) AS denied, userIdentity.userName
FROM cloudtrail_logs WHERE errorCode IS NOT NULL
  AND year='2026' AND month='06'
GROUP BY eventName, userIdentity.userName ORDER BY denied DESC LIMIT 20;

-- IP lạ gọi API? (ngoài office range)
SELECT sourceIPAddress, userIdentity.userName, COUNT(*) AS calls
FROM cloudtrail_logs WHERE sourceIPAddress NOT LIKE '203.0.113.%'
  AND year='2026' AND month='06'
GROUP BY sourceIPAddress, userIdentity.userName ORDER BY calls DESC;

-- Root user activity (phải CỰC HIẾM)
SELECT eventTime, eventName, sourceIPAddress
FROM cloudtrail_logs WHERE userIdentity.type = 'Root'
  AND year='2026' ORDER BY eventTime DESC;

aws logs put-metric-filter --log-group-name cloudtrail \
  --filter-name "RootUserActivity" \
  --filter-pattern '{ $.userIdentity.type = "Root" }' \
  --metric-transformations metricName=RootUserActivity,metricNamespace=CloudTrailMetrics,metricValue=1