RQL query to check for any Change in role for Instance

[APaul]

I am trying to create an RQL query, which will check if anyone attaches or modify roles to an AWS instance.

I am using the below Query :

event where cloud.account = 'My-AWS' AND operation = 'AddRoleToInstanceProfile'

I did some testing on one of the instances. However, I am not able to get any result.

Please help on the correct RQL

[kchen]

I was able to find results with that operation, so I don't think RQL is the issue.  Are you sure the events for your AWS instance is being ingested?

[VPackeriswamy]

Hi Kchn

If possible can you please share your RQL for our reference to identify the recently modified roles to an AWS instance,?

[JJoly]

Hello @APaul,

Thanks for your good question. I will reuse your query 😀

You could use also 'AttachRolePolicy' or 'AttachSecurityProfile' if you want to be inform on attachment policy on "critical" role.

JB

[VPackeriswamy]

Hi @JJoly 

I am new to the RQL, can you please share some example queries, please.

Appreciate your help...

Thanks,

VJ

[JJoly]

Hey,

event from cloud.audit_logs where cloud.type = 'AWS' AND operation in ('AttachSecurityProfile', 'AttachRolePolicy')

Could be interesting for monitoring role and policy but you should specify a list a critical roles that you want to monitor.