<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Conducting Cloud IR — API Reference

## AWS CloudTrail

```bash
# Lookup events by username
aws cloudtrail lookup-events --lookup-attributes AttributeKey=Username,AttributeValue=USER

# Lookup by event name
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin

# Lookup by event source
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=iam.amazonaws.com

# Lookup by resource type
aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::EC2::Instance

# Time range
aws cloudtrail lookup-events --start-time 2026-03-10T00:00:00Z --end-time 2026-03-15T23:59:59Z
```

## AWS IAM Containment

```bash
# Attach DenyAll inline policy
aws iam put-user-policy --user-name USER --policy-name DenyAll \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*"}]}'

# Deactivate access key
aws iam update-access-key --user-name USER --access-key-id AKIA... --status Inactive

# Delete access key
aws iam delete-access-key --user-name USER --access-key-id AKIA...

# List MFA devices
aws iam list-mfa-devices --user-name USER

# Revoke role sessions (STS)
aws iam put-role-policy --role-name ROLE --policy-name RevokeOldSessions \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"*","Resource":"*","Condition":{"DateLessThan":{"aws:TokenIssueTime":"2026-03-15T00:00:00Z"}}}]}'
```

## AWS Evidence Preservation

```bash
# Snapshot EBS volume
aws ec2 create-snapshot --volume-id vol-xxx --description "IR evidence"

# Isolate EC2 (new security group)
aws ec2 create-security-group --group-name ir-isolate --description "IR isolation" --vpc-id vpc-xxx
aws ec2 modify-instance-attribute --instance-id i-xxx --groups sg-xxx

# Export IAM state
aws iam get-account-authorization-details > iam-snapshot.json

# Tag evidence
aws ec2 create-tags --resources snap-xxx --tags Key=IRCase,Value=INC-2026-001
```

## Azure Investigation

```bash
# Activity log by caller
az monitor activity-log list --caller user@domain.com --start-time 2026-03-10

# Sign-in logs (Graph API)
az rest --method get --url "https://graph.microsoft.com/v1.0/auditLogs/signIns?\$filter=userPrincipalName eq 'user@domain.com'"

# Disable user
az ad user update --id user@domain.com --account-enabled false

# Revoke sessions
az rest --method post --url "https://graph.microsoft.com/v1.0/users/USER_ID/revokeSignInSessions"
```

## GCP Investigation

```bash
# Admin activity logs
gcloud logging read 'logName="projects/PROJECT/logs/cloudaudit.googleapis.com%2Factivity" AND protoPayload.authenticationInfo.principalEmail="user@domain.com"' --limit 100

# IAM policy changes
gcloud logging read 'resource.type="project" AND protoPayload.methodName="SetIamPolicy"' --limit 50

# Disable service account
gcloud iam service-accounts disable SA@PROJECT.iam.gserviceaccount.com

# Delete service account key
gcloud iam service-accounts keys delete KEY_ID --iam-account SA@PROJECT.iam.gserviceaccount.com
```

## Common Patterns

### Cloud IR Priority Order

```
1. Identify compromised credentials/roles
2. Revoke sessions and deactivate keys
3. Apply DenyAll policies
4. Preserve evidence (snapshots, log exports)
5. Investigate scope via audit logs
6. Terminate unauthorized resources
7. Rotate all affected credentials
8. Review and harden IAM policies
```

### Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `username` | IAM user or principal | `admin-user` |
| `access_key_id` | AWS access key | `AKIA...` |
| `instance_id` | EC2/VM instance | `i-0abc123` |
| `trail_name` | CloudTrail trail | `management-trail` |
| `log_days` | Days of logs to search | `7` |
