Lion Cipher Lab
Validate a CloudTrail-style digest chain and catch a deleted log (and see what it can't catch)
- Cloud Security
- Intermediate
- ~75 min
- Free · no account required
Why it matters
CloudTrail is the record of who did what in an AWS account, and in a cloud incident it is often the ONLY record. That makes it the first thing a careful intruder goes after: erase the CreateAccessKey that gave them persistence, rewrite the source IP, or just turn logging off for a while. Log file validation is AWS's answer, and the beginner lab had you switch it on. But a checkbox you do not understand is a checkbox you will over-trust. An investigator who says 'validation passed, so the logs are complete' is making a claim the mechanism does not support. Validation proves that the files that…
What you'll learn
- what CloudTrail log file integrity validation actually is: hourly DIGEST files that list the SHA-256 hash of every log file delivered that hour, each digest RSA-signed and chained to the previous digest
- building a faithful offline replica of that documented scheme with Python's standard library and the openssl command line -- your own keypair, your own synthetic logs, your own signed hourly digests
- recreating the documented data signing string (end time, digest path, digest hash, previous signature) and verifying a signature by hand with `openssl dgst -verify`
- writing a validator that works the way `aws cloudtrail validate-logs` is documented to: start at the newest digest, verify it, check every log it lists, then walk the chain backwards
- measuring exactly which tampering a digest chain catches (an edited event, a deleted log, a deleted middle digest, a re-forged digest) and which it misses (an injected unreferenced file, a truncated tail, a StopLogging gap)
- the controls that close the gaps validation leaves open: a freshness check on the newest digest, S3 Object Lock, a separate log-archive account, and alerts on StopLogging / DeleteTrail
Steps in this lab
- What validation promises, in plain terms (and what this replica is)
- Set up: a scratch folder, Python, openssl, and a signing keypair you own
- Generate 8 hours of synthetic logs and their signed, chained digests
- Verify one digest signature by hand with openssl
- Write the validator: newest digest first, then walk the chain back
- Build six tampered copies of the bucket (the pristine one is never touched)
- Measure what the chain catches: edit, delete-log, delete-digest, forge
- The honest negatives: injection, tail truncation, and a StopLogging gap all pass
- Close the gaps: freshness, Object Lock, a separate archive account, and alerts
- The judgment: what 'validate-logs passed' lets you say, and how a pro uses it