AWS Access
Auditing access in your CloudTrail
Every GovIntel session is named after the engagement and the run that made it, so you can attribute each action in your own audit trail.
Everything GovIntel does in your account appears in your CloudTrail. It is named so you can tell one engagement's access from another's.
The session name
Every session is named:
govintel-<engagement reference>-<run identifier>The role's own trust policy requires it. A session whose name does not begin govintel- cannot be created at all, which means the naming is a property of the access rather than a convention GovIntel follows.
Why a constant name would not do
A single fixed session name would tell you that GovIntel acted, and nothing about which engagement or which run. For a product sold on auditability that is indefensible: you would be unable to reconcile activity in your account against the assessments you commissioned.
What to look for
Filter your CloudTrail on the assumed-role session name. You will see:
- one
AssumeRoleWithWebIdentityevent, federated, at the start of the run - the configuration reads the collectors made, all of them describe and list calls
- no write of any kind, and no data-plane read
What you will not see
No console sign-in, no access key usage, no long-lived credential. The session is federated and short-lived, and the role's maximum session duration is one hour.