performing-cloud-log-forensics-with-athena

# Performing Cloud Log Forensics with AWS Athena ## When to Use - When investigating AWS security incidents that require querying massive volumes of cloud logs - When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs - When building reusable Athena tables with partition projection for ongoing incident response - When hunting for indicators of compromise across multiple AWS log sources simultaneously - When creating evidence-grade SQL queries for compliance audits or legal proceedings ## Prerequisites - AWS account with Athena, S3, and Glue permissions - CloudTrail configured to deliver logs to an S3 bucket - VPC Flow Logs enabled and publishing to S3 - S3 server access logging enabled on target buckets - ALB access logging enabled and publishing to S3 - Python 3.8+ with boto3 installed - Appropriate IAM permissions for Athena queries and S3 access ## Instructions ### Phase 1: Create Athena Database and CloudTrail Table Create a dedicated forensics database and CloudTrail table using partition projection to automatically discover partitions without manual ALTER TABLE statements. ```sql CREATE DATABASE IF NOT EXISTS cloud_forensics; CREATE EXTERNAL TABLE cloud_forensics.cloudtrail_logs ( eventVersion STRING, userIdentity STRUCT< type: STRING, principalId: STRING, arn: STRING, accountId: STRING, invokedBy: STRING, accessKeyId: STRING, userName: STRING, sessi...