Cloudtrail Lake Ai Detection: Detect Risky Console Clicks Immediately

-- CloudTrail Lake — illustrative
SELECT eventTime, eventName, recipientAccountId,
       userIdentity.arn AS principal,
       sourceIPAddress, userAgent,
       element_at(requestParameters, 'policyArn') AS policyArn
FROM example_event_data_store
WHERE eventTime >= date_add('minute', -15, current_timestamp)
  AND eventName IN (
    'AuthorizeSecurityGroupIngress',
    'PutUserPolicy', 'AttachUserPolicy', 'CreateAccessKey',
    'DeleteTrail', 'StopLogging', 'PutBucketPolicy'
  )
  AND userIdentity.sessionContext.sessionIssuer.userName IS NULL -- console-ish

// investigate/narrate.ts
export type TrailRow = {
  eventTime: string;
  eventName: string;
  principal: string;
  sourceIPAddress: string;
  requestParameters?: Record<string, unknown>;
};

export const SYSTEM = `You explain CloudTrail rows.
Every sentence that asserts a fact MUST end with [eventTime|eventName|principal].
If unsure, say UNKNOWN. Never invent API calls.`;

export function buildPrompt(rows: TrailRow[]): string {
  // ✅ Pass compact JSON only — strip secrets from requestParameters
  return JSON.stringify(rows.map(sanitize), null, 2);
}

❌ Bad: "Alice probably opened SSH to the world around lunch."
✅ Good: "AuthorizeSecurityGroupIngress from arn:... at 2026-09-11T07:02:11Z
added 0.0.0.0/0:22 [2026-09-11T07:02:11Z|AuthorizeSecurityGroupIngress|arn:...]."

# lambda/trail_watch.py
def handler(event, _ctx):
    rows = run_lake_query(HIGH_RISK_SQL)
    if not rows:
        return {"ok": True}
    narrative = bedrock_converse(SYSTEM, build_prompt(rows))
    if not citations_valid(narrative, rows):  # ✅ reject ungrounded
        raise SystemExit("ungrounded_narrative")
    sns_publish(title="Risky console activity", body=narrative)