HackBlue

Tools · AWS detection and investigation · 22 / 24

CloudTrail Lake: readOnly is about this call

readOnly on a Lake row says whether that API call was a read. It does not say the principal can only read, and it does not say the resource never changes. Write the flag with the event name.

11 min read · practice only with authorization

The flag describes this event

A management row can include readOnly. True means this call was recorded as a read. False means this call was recorded as a change. The flag is about the event name on this row.

It is not a policy. A principal who made a read on this row may have made a write on another row. You only know the calls you have in front of you.

The event name says which call

eventName is the API. readOnly is the flag beside it. Quote them together. A true flag with no event name is incomplete: you cannot say which read it was.

If readOnly is absent, write “readOnly not on this row.” Do not decide from the event name’s spelling unless you also looked the name up and you say that you did.

What to file

File eventID, eventName, and readOnly. If you claim the principal never writes, that claim needs every relevant row, not one true flag. One true flag supports “this call was a read.”

Worked case: one read filed as a read-only role

A lab row shows eventName DescribeInstances, readOnly true, for role lab-read in account 111122223333. A draft says the role cannot change anything because this flag is true.

The note quotes DescribeInstances and readOnly true as this call. It does not describe the role’s permissions. Other event names were not in the paste. The role is not labeled read-only from this row.

Snippet
eventName: DescribeInstances
readOnly: true
role: lab-read
account: 111122223333
other rows in the paste: none
write: this call was a read
not: the role cannot change anything

Diagram

What one readOnly value covers

The flag is this event, not the principal’s whole history.

  • true

    This call was recorded as a read. Name the event with it.

  • false

    This call was recorded as a change. Still only this call.

  • Absent

    Say the flag was not on the row. Do not infer it.

  • The role

    Not described by one flag. Other rows would be other calls.

Check yourself

1. readOnly is true on a DescribeInstances row. What is true?

2. You want to say the role made no changes that week. What do you need?

3. readOnly is missing and eventName is present. What do you write for the flag?