Beyond the Application: Understanding OWASP Risk in AWS
OWASP A09
Logging & Alerting Failures

Logging Is Not Detection: Turning AWS IAM Events Into Security Context

CloudTrail records what happened. It does not tell you whether a policy change created a privilege-escalation path or whether a new trust expanded your attack surface.

7 min readJuly 6, 2026

Organizations often say: we have CloudTrail enabled, so IAM activity is covered. CloudTrail records events. It does not automatically explain whether an event is dangerous, whether the affected role is highly privileged, whether a new policy creates a privilege-escalation path, whether an external trust expanded the attack surface, or whether a modified permission increases access to sensitive data.

OWASP A09 focuses on failures to record, monitor and alert on security-relevant activity.

Logs are records, not conclusions

Consider the following CloudTrail events:

Routine administration — or an attack?
AttachRolePolicy
PutRolePolicy
UpdateAssumeRolePolicy
CreateAccessKey
CreatePolicyVersion
SetDefaultPolicyVersion

Individually, these may appear to be routine administration. But they could represent a role receiving administrator access, a new backdoor access key, a trust policy allowing an external account, a privilege-escalation attempt, or a dormant policy being replaced with a dangerous version. Raw logging tells you what happened. Security context tells you why it matters.

Why event severity depends on identity context

The same event name carries very different risk:

CreateAccessKey for a restricted developer
        !=
CreateAccessKey for an inactive administrator

How Securitain connects activity with posture

The intended investigation flow moves from event to action:

CloudTrail event
Affected identity
Effective permissions
Related findings
Privilege-escalation paths
Blast radius
Recommended action

Securitain includes CloudTrail IAM activity ingestion, an IAM activity timeline, identity and policy inventory, related findings, risk scores, privilege-escalation and blast-radius analysis, scan history, evidence and remediation records, and exportable reports. Its optional audit role grants read-only CloudTrail metadata and event-lookup permissions specifically to inspect IAM-related activity.

Important product boundary

Securitain does not replace a SIEM, Amazon Security Lake, an enterprise SOC, real-time incident response, GuardDuty or CloudWatch alarms. A better claim: Securitain adds IAM security context to cloud activity and posture findings, helping teams investigate which identity changes deserve attention.

Building an OWASP-aligned detection process

  • Securitain for IAM posture and investigation context.
  • CloudTrail for audit events.
  • GuardDuty for managed threat detection.
  • Security Hub for aggregated findings.
  • SIEM or SOC workflows for centralized alerting and response.

Having logs proves an event was recorded. Understanding identity context tells you whether it was routine administration or the beginning of an attack.

Securitain provides read-only AWS IAM and security-posture analysis through temporary STS sessions. It helps teams understand identities, effective permissions, attack paths, resource exposure and remediation opportunities without requiring permanent administrative access to the customer's AWS account.

Back to series