How to Detect and Alert on AWS Root User Activity

Quick Answer

Detecting and alerting on root user activity depends on a chain of services where each hands off to the next: CloudTrail actually records every API call made by the root user, since root activity is logged just like any other principal's. From there, Amazon CloudWatch Logs comes into play because CloudTrail can deliver its events into a CloudWatch Logs group, making root-user activity queryable and filterable in near real time rather than only available as static log files in S3. Amazon CloudWatch Events, now EventBridge, turns a specific event, such as any API call made by the root user, into an action, matching a rule against the CloudTrail-sourced event and triggering a notification through SNS or a remediation step through Lambda. The concept to hold onto is that root-user monitoring is rarely a single service's job; it is a pipeline where CloudTrail supplies the raw event data, CloudWatch Logs or EventBridge watches for a specific pattern such as a root login or API call, and SNS or Lambda delivers the alert. Whenever a question asks which THREE services combine to detect and alert on a specific kind of account activity, expect a logging source, a matching or filtering mechanism, and a notification target, rather than a single all-in-one service.