ConsoleLogin in CloudTrail: Reading AWS Console Sign-In Events

What it records

CloudTrail writes a ConsoleLogin record each time someone tries to sign in to the AWS Management Console: the root user, an IAM user with a password, or a federated user arriving through an identity provider. The event comes from signin.amazonaws.com, and in AWS’s example records it carries eventType AwsConsoleSignIn, is a management event and has readOnly set to false.

The outcome is in responseElements.ConsoleLogin, either Success or Failure. Failed attempts add errorMessage but no errorCode, which is the detail most queries get wrong. AWS’s examples show two reasons: Failed authentication (a real user, wrong password) and No username found in supplied account (no such user, and the name typed is replaced by HIDDEN_DUE_TO_SECURITY_REASONS). additionalEventData.MFAUsed records whether an MFA device was used, additionalEventData.LoginTo the console address the sign-in led to, and requestParameters is always null because the password is never logged.

The Region in the record is the sign-in endpoint’s, not the user’s. Root sign-ins are recorded in us-east-1, us-east-2 or us-west-2. An IAM user signing in through the global endpoint is recorded in us-east-1, or in us-east-2, eu-north-1 or ap-southeast-2 when the browser holds an account alias cookie, and a Regional endpoint records its own Region. A search limited to the Region you work in misses sign-ins, so query a multi-Region or organization trail.

When it matters

Console sign-ins are where stolen passwords turn into hands-on access, and the record holds enough to separate routine use from takeover:

• Root user sign-ins. In most accounts the root user is used for a handful of tasks a year. Any userIdentity.type of Root, successful or not, should be explained by someone.
• Success without MFA. MFAUsed set to No on a successful sign-in by an administrator or by root means a password alone opened the console.
• Many failures, then a success. Several Failed authentication records from one sourceIPAddress against one user name is password guessing; failures against many names from one address is spraying, and a run of hidden user names means the names themselves are being guessed. A Success from the same address afterwards means a password worked (MITRE ATT&CK T1110, then T1078.004).
• A new console user. A ConsoleLogin by an IAM user who normally works only with access keys, shortly after a CreateLoginProfile or UpdateLoginProfile for that user, is a classic way to turn a stolen key into console access.

How to investigate

1. Pull every ConsoleLogin for the account and period from all Regions, then split by userIdentity.type and outcome.
2. For failures, group by sourceIPAddress, errorMessage and userIdentity.userName, and look for a later success from the same address. Some failed records carry the user name without an ARN, so join on the name.
3. For successes, check MFAUsed, compare sourceIPAddress and userAgent with the user’s history, and look for DeactivateMFADevice, CreateLoginProfile or UpdateLoginProfile calls involving the same user beforehand.
4. Follow the session: search the next hours for calls by the same userIdentity.arn from the same address.

Failed sign-ins by source address in Microsoft Sentinel, with any success from that address in the same week:

AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventName == "ConsoleLogin"
| extend Outcome = tostring(parse_json(ResponseElements).ConsoleLogin)
| summarize Failures = countif(Outcome == "Failure"), Successes = countif(Outcome == "Success"),
    Users = make_set(UserIdentityUserName, 50), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIpAddress
| where Failures >= 5
| order by Failures desc

Successful sign-ins by root, or by anyone without MFA:

AWSCloudTrail
| where EventName == "ConsoleLogin"
| extend Outcome = tostring(parse_json(ResponseElements).ConsoleLogin),
    MfaUsed = tostring(parse_json(AdditionalEventData).MFAUsed)
| where Outcome == "Success" and (UserIdentityType == "Root" or MfaUsed == "No")
| project TimeGenerated, UserIdentityType, UserIdentityArn, SourceIpAddress, UserAgent, MfaUsed, AWSRegion

The same question in Athena, over a table on the trail’s S3 bucket (named cloudtrail_logs here):

SELECT eventtime, useridentity.type, useridentity.arn, sourceipaddress,
       json_extract_scalar(responseelements, '$.ConsoleLogin') AS outcome,
       json_extract_scalar(additionaleventdata, '$.MFAUsed') AS mfa_used
FROM cloudtrail_logs
WHERE eventname = 'ConsoleLogin'
ORDER BY eventtime DESC
LIMIT 200;

If a whole export is in front of you, the free log analyzer reads CloudTrail files in the browser and flags bursts of failed console sign-ins and root activity.