Performing Cloud Log Forensics with AWS Athena

When to Use

• When investigating AWS security incidents that require querying massive volumes of cloud logs
• When performing forensic analysis across CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs
• When building reusable Athena tables with partition projection for ongoing incident response
• When hunting for indicators of compromise across multiple AWS log sources simultaneously
• When creating evidence-grade SQL queries for compliance audits or legal proceedings

Prerequisites

• AWS account with Athena, S3, and Glue permissions
• CloudTrail configured to deliver logs to an S3 bucket
• VPC Flow Logs enabled and publishing to S3
• S3 server access logging enabled on target buckets
• ALB access logging enabled and publishing to S3
• Python 3.8+ with boto3 installed
• Appropriate IAM permissions for Athena queries and S3 access

Instructions

Phase 1: Create Athena Database and CloudTrail Table

Create a dedicated forensics database and CloudTrail table using partition projection to automatically discover partitions without manual ALTER TABLE statements.

CREATE DATABASE IF NOT EXISTS cloud_forensics;

…