An IAM user shows repeated failed console sign-ins followed by a successful login from an unfamiliar address. Investigate the activity, build a threshold-based detector, and deliver an email notification to the security team.
Enter your name exactly as it should appear on your certificate.
Your lab runs entirely in this browser. No cloud account is required.
Review management events recorded in the last 90 days.
Repeated password failures were followed by a successful console login. Filter by ConsoleLogin, inspect the sequence, and identify the affected IAM identity and source.
Narrow the event history to authentication activity.
6 matching events · 16 August 2026
| Event time (UTC) | User name | Result | Source IP | MFA |
|---|---|---|---|---|
| 03:56:12 | Failure | 198.51.100.84 | No | |
| 03:56:49 | finance-ops | Failure | 198.51.100.84 | No |
| 03:57:31 | finance-ops | Failure | 198.51.100.84 | No |
| 03:58:06 | finance-ops | Failure | 198.51.100.84 | No |
| 03:59:18 | finance-ops | Failure | 198.51.100.84 | No |
| 04:00:03 | finance-ops | Success | 198.51.100.84 | No |
Five failures were followed by a successful non-MFA login from the same unfamiliar address.
Create an email delivery path for the security team.
Use the approved standard topic name.
Email subscriptions remain pending until the recipient confirms them.
Turn failed CloudTrail console logins into a countable security metric.
Match failed console authentication events in the management-event log group.
Alert when the failed-login threshold is reached within five minutes.
Replay synthetic failed-login events after the filter, alarm, and notification path are ready.
Messages generated by the challenge appear here. No real email is sent.
Create an email subscription to receive its confirmation request.
You requested an email subscription for the following topic:
arn:aws:sns:us-east-1:482193607715:iam-security-alertsConfirm this training subscription to allow security alerts to be delivered.
Training token: LAB-CONFIRM-2026Recommended action: Disable credentials, revoke active sessions, investigate the successful login, and require MFA.
Record the compromised identity, suspicious source, and notification destination.
RCW optional CloudShell
GUI and CLI actions share the same challenge state. Enter help for commands.You identified the compromised IAM user, detected repeated failed console sign-ins, and delivered the threshold alert to security-team@rcwittraining.in.
IAM compromise alert successfully validated
Issued by RCW IT Training and signed by Pradeep Raju.
