A serverless, event-driven cloud security monitoring pipeline that automatically analyzes AWS CloudTrail logs, detects suspicious activity in near real-time, and delivers automated alerts - built to reflect real-world SOC practices.
Watch Demo Video | AWS, Python, Lambda, DynamoDB, SNS, API Gateway
Cloud environments generate massive volumes of security logs. Manual monitoring is slow, error-prone, and leaves organizations exposed. This project automates the full detection-to-alert lifecycle using a fully serverless AWS architecture - detecting threats in under 50 seconds with sub-millisecond query latency.
| AWS Service | Role |
|---|---|
| AWS CloudTrail | Generates audit logs for all AWS account activity |
| Amazon S3 | Secure storage for CloudTrail .json.gz log files |
| AWS Lambda | Serverless Python-based detection engine |
| Amazon DynamoDB | Centralized NoSQL alert storage |
| Amazon SNS | Real-time email alert notifications |
| Amazon API Gateway | REST API (/alerts) for analyst access |
The Lambda detection engine identifies the following high-risk events:
- MFA Bypass - Console logins without multi-factor authentication
- Unauthorized API Calls -
AccessDeniedevents across AWS services - CloudTrail Tampering - Attempts to disable or modify audit logging
Each alert is assigned a severity level and stored in DynamoDB with full event metadata.
- Least-privilege IAM roles - each service only has the permissions it needs
- Encryption at rest - enabled on both S3 and DynamoDB
- HTTPS enforced - via API Gateway for all REST endpoints
- Full auditability - CloudTrail logs all actions taken within the system itself
| Metric | Value |
|---|---|
| Detection latency | < 50 seconds |
| Security events processed | 100+ |
| DynamoDB query latency | Sub-millisecond |
| Architecture cost model | Serverless (pay-per-use) |
- Web-based dashboard for alert visualization
- Integration with threat intelligence feeds (e.g. MISP, VirusTotal)
- Expanded detection rules (privilege escalation, data exfiltration)
- SIEM integration (Elastic, Splunk)