Forensic Account
Definition
A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating the analysis prevents attacker IAM from reaching the evidence.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Service Control Policy
- An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...
Explained in
- Cloud Logging, VM Snapshots and Cloud Incident ResponseA dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefact...