“Why are my CloudTrail logs showing root credentials in use for API actions I didn’t initiate?”

Find more details in the AWS Knowledge Center: https://aws.amazon.com/premiumsupport/knowledge-center/cloudtrail-root-action-logs/
Deren, an AWS Cloud Support Engineer, shows what to check if your CloudTrail logs show that your root credentials are being used to authenticate actions or calls against your AWS resources, even if you didn’t initiate the action or call.

via Amazon Web Services

About The Author
- Launched in 2006, Amazon Web Services offers a robust, fully featured technology infrastructure platform in the cloud comprised of a broad set of compute, storage, database, analytics, application, and deployment services from data center locations in the U.S., Australia, Brazil, China, Germany, Ireland, Japan, and Singapore. More than a million customers, including fast-growing startups, large enterprises, and government agencies across 190 countries, rely on AWS services to innovate quickly, lower IT costs and scale applications globally. To learn more about AWS, visit http://aws.amazon.com.

Tell us what you think...