If you want to secure your AWS Console more than usual, you can make use of CloudTrail, EventBridge and a Lambda Function to trigger webhooks to your server whenever a successful login occurs.
Below, we'll walk you through how to set up your AWS account so
that ConsoleLogin
events trigger a webhook to your
desired endpoint. This can be especially useful for more
advanced teams that want to trigger certain logic when specific
users log into your AWS console (e.g. sending SMS or email
notifications to IT or Security departments).
CloudTrail is a service from AWS that helps you audit and track events that go on within your account (and it's associated resources). At it's simplest, it writes log files for events.
The first thing we want to do is setup a "Trail" within CloudTrail. It's important to note that this is not region or zone specific, so don't worry about that here.
00-management-events
Great! You're now done with CloudTrail!
We now want to create a Lambda Function. This function will be
used to receive events (from EventBridge), and when it matches
our preferred event name (ConsoleLogin
), we're then
going to "rebound" that event over to our preferred URL
endpoint (this is the webhook part).
us-east-1
region / zone)
00-aws-console-login-event-rebounding-function
Node.js 20.x
x86_64
Create function
button
Deploy
button
Okay! You now have an AWS Lambda Function. When it's triggered
(by EventBridge, which we'll get to next), it will check the
event name. If it matches what we're looking to capture (namely,
AWS console login events), it'll trigger your preferred endpoint
URL to be requested (with a POST
payload).
One final thing to do here:
line 58
so that it points to your own endpoint
(instead of the default one).
This is the last step. It's a bit longer, but relatively
straightforward once you grasp it. We're going to create a
"rule" within AWS EventBridge This rule will basically say "when
a user logs into AWS console, trigger a specific Lambda
Function" (the one we just created).
Here we go:
us-east-1
region / zone)
00-aws-console-login-events
default
Rule with an event pattern
AWS events or EventBridge partner events
Use pattern form
AWS services
AWS Console Sign-in
Sign-in Events
Any user
AWS service
Lambda function
00-aws-console-login-event-rebounding-function
Everything should be running smoothly. When a login happens in the AWS console, these three resources should work together to send a POST payload over to your defined endpoint URL.
If you'd like to see a sample of the POST payload that will be "rebounded" (also known as the webhook payload), see the Sample Webhook Payload section below.
If you're having trouble, take a look at the Troubleshooting / Debugging area below, or else, reach out to support@zenlogin.co and we'll do our best to help you out.
If you're having trouble, the first thing to do is head over to your Lambda Function's CloudWatch / Log Group. In this area, you can see log files generated when your Lambda Function is executed. This can point out any runtime errors.
Another considertion is that when you create a Lambda Function,
an associated IAM Role is also created. You can see those
details here:
https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1#/roles
(you should notice a new IAM Role that references the recently
created
00-aws-console-login-event-rebounding-function
Lambda Function).
And one gotcha: for this to work, it assumes login events are
only happening in the us-east-1
region / zone.
There are instances when this doesn't happen, in which case
you'll (unfortunately) need to go through this process again for
each of your zones. For more information, head over here:
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
{
"event": {
"version": "0",
"id": "2da6a4bc-hax7-es2s-57zz-d470a443677d",
"detail-type": "AWS Console Sign In via CloudTrail",
"source": "aws.signin",
"account": "012345678901",
"time": "2024-05-14T23:56:59Z",
"region": "us-east-1",
"resources": [],
"detail": {
"eventVersion": "1.08",
"userIdentity": {
"type": "Root",
"principalId": "012345678901",
"arn": "arn:aws:iam::012345678901:root",
"accountId": "012345678901",
"accessKeyId": ""
},
"eventTime": "2024-05-14T23:56:59Z",
"eventSource": "signin.amazonaws.com",
"eventName": "ConsoleLogin",
"awsRegion": "global",
"sourceIPAddress": "224.23.213.30",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
"requestParameters": null,
"responseElements": {
"ConsoleLogin": "Success"
},
"additionalEventData": {
"LoginTo": "https://us-west-2.console.aws.amazon.com/ec2/v2/home?hashArgs=%23Instances%3A&isauthcode=true®ion=us-west-2&state=hashArgsFromTB_us-west-2_b143de86f65714a7",
"MobileVersion": "No",
"MFAUsed": "No"
},
"eventID": "59ba21zd-0z2z-4d49-a1f2-6e296b9e935e",
"readOnly": false,
"eventType": "AwsConsoleSignIn",
"managementEvent": true,
"recipientAccountId": "012345678901",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "signin.aws.amazon.com"
}
}
}
}
Secure your users accounts with a few lines of code.