A root console login without MFA

Query a CloudTrail export with jq. Find the root sign-in, check whether MFA was used, and follow what root did next, including the new user and access key it created.

Terminal mission
Intermediate
4 objectives
0 of 4 solved

Briefing

GuardDuty raised a finding for root credential usage in the production account. The CloudTrail file for the morning is at /cases/cloudtrail/2026-03-14.json.

Each CloudTrail event has eventName, userIdentity.type, sourceIPAddress, and sometimes additionalEventData. Root is the one identity that should almost never appear.

analyst@ir-ws

ir-ws · Cloud CLI review

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@ir-ws:~$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.