AWS Security Monitoring System

Challenge

Ensuring visibility and real-time alerting for access to sensitive credentials stored in AWS Secrets Manager.

Solution

This project implements a serverless security monitoring system in AWS to detect and alert on access to sensitive secrets stored in Secrets Manager. The system captures secret access events, analyzes them, and sends real-time notifications to administrators, ensuring automated security monitoring and compliance.

Key Components:

• Secrets Manager: Stores sensitive data (API keys, credentials) as encrypted key-value pairs.
• CloudTrail: Logs all management events, including secret access, and stores them in S3 for long-term retention.
• CloudWatch Logs: Aggregates CloudTrail logs, enabling filtering, metric creation, and event analysis.
• CloudWatch Metric Filters & Alarms: Count secret access events and trigger alerts when thresholds are met.
• SNS (Simple Notification Service): Sends email notifications to alert administrators immediately.

Architecture overview