IAM - Failed login attempts go un-noticed

[msaindane]

CloudTrail is not enabled by default. Unsuccessful login attempts will not be logged unless CloudTrail is enabled.

NOTE: unsuccessful sign-in events by the root user are not logged by CloudTrail.

Mitigation:

• Enable CloudTrail to log all sign-in attempts

Reference: http://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html

[msaindane]

Or should this be under CloudTrail?

There are other threats associated with CloudTrail that needs to be aware of as well.

[zeroXten]

I would say the threat in this case applies to IAM, but the mitigation is via CloudTrail and you'd still have to monitor those specific event types.