performing-cloud-log-forensics-with-athena - Perform AWS Cloud Log Forensics with Athena
Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation.
Tags
Updated: 2026-09-29Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Create Athena forensic databases
- Define partition-projected log tables
- Query CloudTrail events
- Analyze VPC Flow Logs
- Analyze S3 access logs
- Analyze ALB access logs
- Detect unauthorized access
- Investigate data exfiltration
- Investigate lateral movement
- Investigate privilege escalation
Inputs
- CloudTrail logs
- VPC Flow Logs
- S3 access logs
- ALB access logs
- S3 bucket locations
- AWS account identifiers
- AWS region identifiers
- Forensic SQL queries
Outputs
- Athena forensic database
- External log tables
- Forensic query results
Requirements
- AWS account
- Athena permissions
- S3 permissions
- Glue permissions
- CloudTrail S3 delivery
- VPC Flow Logs enabled
- S3 server access logging enabled
- ALB access logging enabled
- Athena query IAM permissions
- Python 3.8 or later
- boto3 installed