Using Amazon Q Developer and MCP to Investigate AWS CloudTrail Activity
· 6:55 · Watch on YouTube ↗
Summary
A walkthrough configures Amazon Q Developer with an MCP server and AWS credentials to query CloudTrail. An initial search returns no events; a later query finds activity characterized as legitimate administrative tasks.
Key points
- The video demonstrates using Amazon Q Developer with an MCP server to query AWS CloudTrail during an activity investigation.
- The setup includes configuring AWS credentials and adding the CloudTrail MCP server in the IDE.
- The user authorizes the proposed event lookup before Amazon Q retrieves CloudTrail results.
- An initial search for a user's activity over the past hour returns no events; the video notes possible explanations including an incorrect username or region.
- After the presenter performs activity in the AWS account, a later query returns events that Amazon Q characterizes as legitimate administrative tasks rather than suspicious behavior.
Article Details
- Topics
- [00:14] CloudTrail event lookup and analytics capabilities
- [01:06] Amazon Q Developer and the CloudTrail MCP server setup
- [02:23] Configuring AWS credentials and an AWS CLI profile
- [03:10] Adding and configuring the MCP server in the IDE
- [04:09] Querying CloudTrail for suspicious activity and receiving no events
- [05:13] Running account activity and querying CloudTrail again
- [06:22] Reviewing events characterized as legitimate administrative tasks