Infra Audit5 min readUpdated November 4, 2026

Your AWS Account Logs Everything and Watches Nothing

CloudTrail exists by default but only in one region. GuardDuty is off. Budgets are empty. The audit checks all three in one pass.

Check that CloudTrail is multi-region with log file validation, GuardDuty is enabled, and at least one budget exists with alerts. Without these, an intrusion in another region leaves no trace and no bill alarm.

A fresh AWS account logs management events in one region, runs no detection, and has no budgets. An attacker who lands in another region, or who mines on an exposed ECS task, operates without a single alarm.

See How We Work

In This Guide

The default state is silence

A fresh AWS account logs management events in one region, runs no detection, and has no budgets. An attacker who lands in another region, or who mines on an exposed ECS task, operates without a single alarm.
A fresh AWS account logs management events in one region, runs no detection, and has no budgets. An attacker who lands in another region, or who mines on an exposed ECS task, operates without a single alarm. The audit checks all three in one pass and reports the gaps as confirmed findings, because each has a documented incident class behind it.

The check

aws cloudtrail describe-trails: flag IsMultiRegionTrail false or missing log file validation. aws guardduty list-detectors: empty means off. aws budgets describe-budgets: empty means no alarm exists for the one symptom every compromise eventually shows. Each fix is a console click or one command, and the audit re-verifies after.
aws cloudtrail describe-trails: flag IsMultiRegionTrail false or missing log file validation. aws guardduty list-detectors: empty means off. aws budgets describe-budgets: empty means no alarm exists for the one symptom every compromise eventually shows. Each fix is a console click or one command, and the audit re-verifies after.

If it stays

The account keeps its black box: incidents in unlogged regions are invisible, mining runs until the bill arrives, and the bill arrives without an alarm. Detection is the cheapest layer of the whole audit, and the only one that helps after the fact.
The account keeps its black box: incidents in unlogged regions are invisible, mining runs until the bill arrives, and the bill arrives without an alarm. Detection is the cheapest layer of the whole audit, and the only one that helps after the fact.

Get the skill

The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times.
The checks in this guide come from the roqy audit skill, open source at https://github.com/roncoo-2/roqy-audit. It runs read-only against your own account, produces findings with verdicts (confirmed, needs_validation, rejected), and was validated on a live canary AWS account where 9 planted misconfigurations were detected 9 out of 9 times. The full canary report is in the repository under docs/runs. Copy the skill into any coding agent, point it at your stack, and get the same report for your account.

4 Tips to Get Started

1

aws cloudtrail describe-trails shows the config. IsMultiRegionTrail false means half the world unlogged.

2

GuardDuty off means crypto-mining and key misuse run unannounced. Enable it: the cost is small, the signal is real.

3

A budget with an alert is the only alarm that fires on a crypto-mining bill spike.

4

Log group retention null means the logs themselves bill forever. Set 90 or 365 days.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

Is CloudTrail enabled by default?

Partially. AWS records management events to a default trail you can read for 90 days, but it is single-region and not delivered to your S3. For real coverage you need a multi-region trail with log file validation delivered to S3, so events from every region are retained and queryable.

What does GuardDuty actually do?

It analyzes CloudTrail, VPC flow logs and DNS logs for known attack patterns: credential exfiltration, crypto-mining, unusual API calls. It is managed, needs no agents, and costs pennies on small accounts. Off means these patterns run unannounced.

Why do budgets matter for security?

The most common visible symptom of a compromise is a bill spike: crypto-mining on exposed compute, data transfer from exfiltration. A budget with an alert at a threshold is the alarm that fires when nothing else does.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works