Identity at the server side layer

# ABOUTME: Kubernetes API server audit policy. Captures every agent SA action; identity-binding events at full request body.
# ABOUTME: Apply with --audit-policy-file= on kube-apiserver. Combined with --audit-log-path= or an audit webhook to a SIEM.
apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
- RequestReceived

rules:

# 1. All agent SA mutations at RequestResponse level (full body).
- level: RequestResponse
  users:
  - "system:serviceaccount:agent-*"
  verbs: ["create", "update", "patch", "delete", "deletecollection"]

# 2. Agent SA reads at Metadata level (which user, which resource, no body).
- level: Metadata
  users:
  - "system:serviceaccount:agent-*"
  verbs: ["get", "list", "watch"]

# 3. Identity-binding events at full body, regardless of who initiated.
# These are the events that change who can do what; logging them at full
# detail lets the SIEM reconstruct privilege changes.
- level: RequestResponse
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["rolebindings", "clusterrolebindings", "roles", "clusterroles"]
- level: RequestResponse
  resources:
  - group: ""
    resources: ["serviceaccounts"]

# 4. Secret reads/writes at full body. Secrets are credential material.
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  verbs: ["get", "create", "update", "patch", "delete"]

# 5. Drop noisy health checks and well-known events that do not warrant
# durable audit storage. Tune for your cluster's actual chatter.
- level: None
  users:
  - "system:kube-proxy"
  - "system:kube-scheduler"
  - "system:kube-controller-manager"
  resources:
  - group: ""
    resources: ["endpoints", "services", "nodes"]
  verbs: ["get", "list", "watch"]

# 6. Default: log at Metadata level so we have at least the who-and-what
# for everything not covered above.
- level: Metadata

#!/usr/bin/env bash
# ABOUTME: Provisions a multi-region CloudTrail trail delivering to an Object-Lock S3 bucket with log-file validation.
# ABOUTME: Pair with the immutable-backup bucket from controls/blast-radius/server-side/. Trail name is per-environment.

set -euo pipefail

TRAIL_NAME="${TRAIL_NAME:-agent-audit}"
BUCKET="${BUCKET:-agent-cloudtrail-immutable}"
REGION="${AWS_REGION:-us-east-1}"

if [[ -z "${AWS_PROFILE:-}" ]]; then
  echo "Set AWS_PROFILE to a profile with cloudtrail:CreateTrail and s3:PutBucketPolicy." >&2
  exit 1
fi

# Bucket policy that allows CloudTrail to write but no one to delete.
# Object Lock on the bucket prevents log tampering even with bucket-write.
cat > /tmp/cloudtrail-bucket-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::${BUCKET}"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": { "Service": "cloudtrail.amazonaws.com" },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::${BUCKET}/AWSLogs/*",
      "Condition": {
        "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" }
      }
    }
  ]
}
EOF

aws --profile "$AWS_PROFILE" s3api put-bucket-policy \
  --bucket "$BUCKET" \
  --policy file:///tmp/cloudtrail-bucket-policy.json

aws --profile "$AWS_PROFILE" cloudtrail create-trail \
  --name "$TRAIL_NAME" \
  --s3-bucket-name "$BUCKET" \
  --include-global-service-events \
  --is-multi-region-trail \
  --enable-log-file-validation

aws --profile "$AWS_PROFILE" cloudtrail put-event-selectors \
  --trail-name "$TRAIL_NAME" \
  --event-selectors '[{
    "ReadWriteType": "All",
    "IncludeManagementEvents": true,
    "DataResources": [
      {"Type": "AWS::S3::Object", "Values": ["arn:aws:s3:::"]},
      {"Type": "AWS::Lambda::Function", "Values": ["arn:aws:lambda"]}
    ]
  }]'

aws --profile "$AWS_PROFILE" cloudtrail start-logging --name "$TRAIL_NAME"

echo "CloudTrail $TRAIL_NAME provisioned and logging."
echo ""
echo "Subscribe a SIEM to the trail via EventBridge:"
echo "  aws events put-rule --name agent-cloudtrail-to-siem \\"
echo "    --event-pattern '{\"source\":[\"aws.cloudtrail\"]}' "

# ABOUTME: Sigma detection rule for agent SA used outside the expected business-hours window.
# ABOUTME: Tune the hours range, weekend behavior, and on-call exception list for your team's working pattern.
title: Agent identity used outside expected hours
id: 6f6c8b3a-1e2d-4a3c-9d4e-3b7c8a9f0e1d
status: experimental
description: >
  Detects use of an agent ServiceAccount or IAM principal outside the
  expected business-hours window. Most agents in our environment operate
  09:00-18:00 weekdays. Off-hours activity is an indicator of compromised
  credentials, a forgotten cron job firing under an agent identity, or a
  legitimate but undocumented operator action.
references:
  - https://github.com/peopleforrester/agentic-covenants/blob/main/SENTINELS_MATRIX.md
author: agentic-covenants
date: 2026/05/08
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    user.username|startswith: 'system:serviceaccount:agent-'
  filter_business_hours:
    requestReceivedTimestamp|in_window:
      hours_local: '09:00..18:00'
      weekdays: ['Mon', 'Tue', 'Wed', 'Thu', 'Fri']
  filter_oncall_exceptions:
    user.username|in:
      - 'system:serviceaccount:agent-oncall-pager:rotate-on-call'
  condition: selection and not filter_business_hours and not filter_oncall_exceptions
falsepositives:
  - On-call rotation agents (add to filter_oncall_exceptions).
  - Engineers running agents during incident response (treat as alert worth surfacing, not silencing).
  - Cross-timezone teams (parameterize hours_local per agent or per region).
level: medium
tags:
  - agent
  - identity
  - sentinels

# ABOUTME: Sigma detection rule for agent identity used from a source IP outside the known agent-egress set.
# ABOUTME: known_agent_ips_lookup is a SIEM lookup table the operator maintains; the rule's correctness depends on it.
title: Agent identity used from unexpected source IP
id: 7e5f9c2b-2f3e-5b4d-ae5f-4c8d9b0e1f2a
status: experimental
description: >
  Detects use of an agent ServiceAccount or IAM principal from a source IP
  not in the known agent-egress set. Agent egress IPs are stable: NAT
  gateway, EKS node CIDR, GitHub Actions IP ranges. A source IP outside this
  set is an indicator of credential exfiltration to an external host or of
  a misconfigured cluster path.
references:
  - https://github.com/peopleforrester/agentic-covenants/blob/main/SENTINELS_MATRIX.md
author: agentic-covenants
date: 2026/05/08
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    userIdentity.sessionContext.sessionIssuer.userName|startswith: 'claude-'
  filter:
    sourceIPAddress|in: '@known_agent_ips_lookup'
  condition: selection and not filter
falsepositives:
  - New NAT gateway provisioned and lookup table not updated (process; do not silence).
  - GitHub Actions runner IP rotation (use the published IP range, not specific IPs).
level: high
tags:
  - agent
  - identity
  - sentinels