AWS is a request factory. Principal, CloudTrail, then the wire.

1. Why AWS is not a session factory

Students who just finished a NGFW lesson look for a 6-tuple and a Session Browser. AWS does not have that object. Official policy evaluation starts with a sentence you should steal: a principal sends a request. The factory either allows that request or denies it. Later, if the request was “open this port” or “put this object,” a packet or a GetObject may happen on the data plane. Mixing those two jobs is how you “fix” a security group while IAM is still at implicit deny.

Three tickets that look the same in chat — “prod is down,” “AccessDenied,” “users get 403” — land on three different stations. Account 123456789012 in us-east-1 as assumed-role SecOpsReview is not the sandbox tab you left open. aws sts get-caller-identity is the first command because every later lookup-events and every describe-security-groups is scoped to wherever that call landed.

Hero · the request factory

2. Mental model — five stations

Hold five stations in order. Interviews fail when people start at station four because Security Groups is the menu they know.

Path · principal before the hop

Principal answers “whose credentials are on this call?” Official STS: GetCallerIdentity returns Account, UserId, and Arn. No extra permission is required to call it. If Account is not the ticket account, stop.

Request context answers “what did they ask, on what, under which conditions?” Official PARC: Principal, Action, Resource, Condition. Environment data includes source IP, user agent, time of day, MFA. AWS compares that context to identity-based policies, resource-based policies, permissions boundaries, Organizations SCPs, Organizations RCPs, and session policies. An explicit deny in any of them wins.

CloudTrail answers “did the factory print a receipt, and what did it say?” Official record: userIdentity is the IAM identity, eventName is the requested action, errorCode / errorMessage appear when the service returned an error. Event history is one account, one Region, one lookup attribute, last 90 days, management events only.

Network path answers “where did the packet go, and which hop dropped it?” Official VPC: a route table is destination + target. A public subnet is a table with 0.0.0.0/0 → internet gateway. A security group is instance-level, allow-only, evaluates all rules, stateful. A NACL is subnet-level, allow and deny, first match in ascending order, stateless — return traffic needs its own rule.

3. Request evaluation vs the wire

Flowchart first. Prose second. Official IAM evaluation is a three-step factory line. Official VPC inbound is a different line. You pick the line from the symptom, not from the menu you like.

On the wire, official inbound order is not the troubleshooting list you memorized. Traffic from an internet gateway is routed to the subnet by the route table. The NACL associated with that subnet is evaluated next. The security group on the ENI is evaluated last. Return traffic is remembered by the security group and forgotten by the NACL. That is why “inbound 443 is open” and the client still hangs is almost always a missing outbound ephemeral range on the NACL (commonly 1024–65535), not a missing App-ID.

4. How to choose the station

You are not choosing a product to buy. You are choosing which factory job to read first. Pick from the table, then stay on that station until you can quote a field.

5. Runbook Side A → B → C

Concept is the five stations. Path is the two factory lines. Do is this runbook. Lab values only — account 123456789012, region us-east-1, role SecOpsReview, app role AppRole, sg-0lab1042, acl-0lab, partner 203.0.113.88. Nothing here is a live tenant.

Side A — name the principal (building the factory badge)

Primary source: STS GetCallerIdentity. Console path: top-right account menu → Account ID. CLI first, always. Official response elements are Account, UserId, Arn. Permissions are not required to call this action.

1. Write the ticket account on the pad

   12-digit ID, Region, and the role the ticket claims. Lab: 123456789012 / us-east-1 / VPC app subnet / assumed-role SecOpsReview.

2. Call STS

   Dummy lab command (same shape as the practice dashboard):

   aws-lab $ · dummy

   aws sts get-caller-identity
   {
     "UserId": "AROAEXAMPLE:lab",
     "Account": "123456789012",
     "Arn": "arn:aws:sts::123456789012:assumed-role/SecOpsReview/lab"
   }

3. Match or stop

   If Account is not the ticket account, you are looking at a twin. Do not open Event history, do not edit a security group, do not “fix” a NACL here. Switch profile or role. Re-run STS. Official: Account is the account that owns or contains the calling entity — not the resource you wish you were in.

Side B — print the CloudTrail receipt (the request)

Primary source: Viewing recent management events with the console + CloudTrail record contents. Console path: CloudTrail → Event history. Official limits: last 90 days, one account, one Region, one lookup attribute plus a time range.

1. Filter Event history on one official attribute

   For a “who opened 443?” ticket: Lookup attributes = Event name, value AuthorizeSecurityGroupIngress. For a console login: Event name = ConsoleLogin. Official: CloudTrail cannot filter on a partial value. The search is this Region only — switch Region if the resource is not in us-east-1.

2. Read the receipt fields

   You need userIdentity.type (IAMUser / AssumedRole / Root), userIdentity.arn, eventSource (for example ec2.amazonaws.com), eventName, sourceIPAddress, and whether errorCode is present. No errorCode means the service accepted the API. It does not mean the partner’s SYN was accepted.

3. If the row is missing, ask which event category

   Official: Event history supports management events only. Amazon S3 object-level APIs — GetObject, PutObject, DeleteObject — are data events (data-plane operations). By default trails do not log them, and Event history never records them. An empty Event history for GetObject is not a broken trail. You need a trail or event data store with data events on AWS::S3::Object, or you switch to IAM simulator for the AccessDenied.

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROAEXAMPLE:lab",
    "arn": "arn:aws:sts::123456789012:assumed-role/SecOpsReview/lab",
    "accountId": "123456789012",
    "sessionContext": { "sessionIssuer": { "userName": "SecOpsReview" } }
  },
  "eventTime": "2026-08-16T10:42:18Z",
  "eventSource": "ec2.amazonaws.com",
  "eventName": "AuthorizeSecurityGroupIngress",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.10",
  "userAgent": "aws-cli/2.17.0",
  "requestParameters": {
    "groupId": "sg-0lab1042",
    "ipPermissions": { "ipProtocol": "tcp", "fromPort": 443, "toPort": 443,
      "ipRanges": [{ "cidrIp": "10.0.0.0/8" }] }
  },
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "123456789012"
}

Say the word receipt. This event proves who called the API and what CIDR they authorized. It does not prove a partner packet was accepted. Side C is the wire.

Side C — walk the network path (the data plane)

Primary sources: Security groups, Network ACLs, Route tables, VPC Flow Logs. Isolate vs change-control lives on the desk. Here the rule is: do not open 0.0.0.0/0 to test.

1. Read the route before you blame a firewall

   Console: VPC → Route tables → the table associated with the app subnet. Official: every table has a local route for the VPC CIDR. A public subnet is a table with destination 0.0.0.0/0 and target igw-. A private subnet has no internet-gateway route. A missing default route looks like a drop and is not a security-group problem.

2. Read NACL inbound and outbound

   Console: VPC → Network ACLs → acl-0lab. Official: numbered rules, first match wins, allow and deny, stateless. If inbound 443 from the partner is allowed and outbound ephemeral (1024–65535) is not, the SYN-ACK dies and the client hangs. Quote the rule number. Do not “open the SG wider” first.

3. Read the security-group Source, then quote flow

   Console: VPC → Security groups → sg-0lab1042 → Inbound rules. Then CloudWatch log group /vpc/flow (or the flow-log destination on the ENI). Dummy:

   aws-lab $ · dummy flow

   aws logs filter-log-events --log-group-name /vpc/flow
   2 123456789012 eni-0lab 10.0.8.22 10.0.9.10 53122 443 6 48 3840 … ACCEPT OK
   2 123456789012 eni-0lab 203.0.113.88 10.0.9.10 53188 443 6 3 180 … REJECT OK

4. Change one hop, under control

   If the SG Source is the miss, add 203.0.113.88/32 TCP 443 with Description INC-1042 partner 443. Do not widen the NACL “just in case.” Do not authorize 0.0.0.0/0 to test. Re-read the same flow filter. Partner SYN should flip from REJECT to ACCEPT. For an IAM ticket, re-run the simulator after you supply the missing context key or attach the missing Allow — that proof is on the evidence desk.

Proof · receipt and flow on the same desk

6. Runtime — after the receipt prints

A successful AuthorizeSecurityGroupIngress is a management event. The new allow is now in the request context of later packets, but the packet still walks the official layers: route table, then NACL, then security group. Official compare table: the security group evaluates all rules before it decides; the NACL evaluates in ascending order and stops at the first match. Default custom NACL is deny-all until you write allows. Default security group allows no inbound.

API path never hits SG or NACL. The caller is AppRole in account 123456789012. AWS assembles PARC, checks every applicable policy type for an explicit Deny, then looks for an Allow. No Allow → implicit deny. A condition key that is not in the request does not satisfy the Allow — the lab simulator reports MissingContextKeys=s3:ExistingObjectTag/Classification and EvalDecision=implicitDeny with MatchedStatements=none.

S3 GetObject is the classic trap after go-live. Official S3 + CloudTrail: object-level APIs are data events / data-plane operations. Event history will stay empty. Bucket-level calls such as CreateBucket or PutBucketPolicy are management events and will show. If the app cannot read an object, do not spend twenty minutes on Event history. Open the IAM policy simulator on arn:aws:iam::123456789012:role/AppRole and action s3:GetObject, then read the bucket policy and — if the object is SSE-KMS — the key policy. KMS is a second door: IAM can Allow GetObject and the key policy can still Deny kms:Decrypt.

7. Traps + proof + desk

Related: AWS evidence desk — first tool + proof field · SG vs NACL deep dive · AWS Security hub

Sources

• IAM — Policy evaluation logic — principal sends a request; authenticate; process request context; evaluate
• IAM — Processing the request context — PARC (Principal, Action, Resource, Condition); policy types compared to the context
• IAM — How AWS enforcement code logic evaluates requests — implicit deny default; explicit allow required; explicit deny wins
• IAM — Explicit and implicit denies
• STS — GetCallerIdentity — Account, UserId, Arn; no extra permission required
• CloudTrail — Record contents — userIdentity, eventSource, eventName, errorCode, requestParameters, eventType
• CloudTrail — Viewing recent management events — Event history, 90 days, one Region, one lookup attribute
• CloudTrail — Logging management events — Event history is management events only
• Amazon S3 — CloudTrail events — GetObject / PutObject / DeleteObject are data events; Event history does not record them
• Amazon VPC — Security groups — stateful allow list on the instance / ENI
• Amazon VPC — Network ACLs — stateless numbered allow/deny on the subnet
• Amazon VPC — Compare security groups and network ACLs — official comparison table + inbound layering
• Amazon VPC — Route tables — destination + target
• Amazon VPC — Internet gateways — public subnet = route to IGW
• Amazon VPC — Flow logs — ACCEPT / REJECT
• IAM — Testing IAM policies with the policy simulator

Related: AWS evidence desk · SG vs NACL · IAM security practices · AWS Security hub