EVALUATING AWS NATIVE APPROACHES FOR DETECTING SUSPICIOUS API CALLS

Summary from the TLDR InfoSec newsletter

A comparison of three methods for detecting suspicious AWS API calls. Eventbridge offers quick response times and low cost but lacks support for multi-account or complex setups. CloudTrail to Lambda provides flexibility and visibility with easy multi-account integrations but is slower. The CloudWatch with Metric Filters approach is faster than Lambda, but increases complexity in AWS pattern syntax.