4 ms·
> * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for wh
by lars_francke 5y ago
> * Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when used, confirmed and audited by relevant persons or teams.
I had never heard of GuardDuty so I got curious.
It doesn't seem like there's a free tier available for it: https://aws.amazon.com/guardduty/pricing/ https://aws.amazon.com/guardduty/pricing/
In fact at larger scales it seems pretty expensive even.
- LilBytes 5y agoYou're absolutely right. I had not noticed. I'd say this was to do with GuardDuty isn't free but has consistently been such a small line item on my AWS bills that I thought it was free. Thank you for the correction. All the same the point I was trying to drive is when the service is incredibly effective, both in practice and cost, it should in nearly all instances be implemented. Edit: I wanted to amend my statement but the window to make those changes has passed.
- lars_francke 5y agoThanks. This seems like a service that _should_ be free and enabled by default at least with a subset of options for the root account.