Automated Alerting for Unusual AI Model Access Patterns with AWS GuardDuty

Question

Pulumi · Accepted Answer

AWS GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts and workloads. Using GuardDuty, we can automate alerting for unusual access patterns, including those that may indicate unauthorized access to AI models.

In the context of your request, GuardDuty can be used to monitor access patterns to AWS services such as Amazon SageMaker, which is often used for AI model development and deployment. GuardDuty can analyze CloudTrail Logs, VPC Flow Logs, and DNS logs to detect suspicious activities such as abnormal API calls or potentially unauthorized deployments that could indicate someone is trying to access AI models in an unusual way.

To set up automated alerting for unusual AI model access patterns with AWS GuardDuty, we will:

1. Enable the GuardDuty detector.
2. Create an IPSet to specify trusted IP addresses if necessary.
3. Define CloudWatch events rules that trigger on GuardDuty findings.
4. Configure an SNS topic (or another notification service) to send alerts when the CloudWatch event rule is activated.

Let's write a Pulumi program in Python to carry out the above steps:

```python
import pulumi
import pulumi_aws as aws

# Step 1: Enable GuardDuty
guardduty_detector = aws.guardduty.Detector("aiModelAccessDetector", enable=True)

# Optionally, you can also set up an IPSet which specifies IP addresses that you trust and do not want GuardDuty to generate findings for.
# In this case, you would provide a file on S3 with the trusted IPs, and configure the IPSet like this:

# trusted_ip_set = aws.guardduty.IPSet("trustedIPSet",
#                                      activate=True,
#                                      format="TXT",
#                                      location="s3://your-trusted-ip-list-bucket/trusted-ip-set.txt",
#                                      detector_id=guardduty_detector.id,
#                                      )

# Step 2: Define CloudWatch event rule based on GuardDuty findings
event_pattern = """{
  "source": ["aws.guardduty"],
  "detail-type": ["GuardDuty Finding"],
  "detail": {
    "service": {
      "action": {
        "actionType": ["AWS_API_CALL"]
      },
      "resource": {
        "resourceType": ["Instance", "AccessKey"]
      }
    }
  }
}"""

# Create the CloudWatch event rule
cloudwatch_event_rule = aws.cloudwatch.EventRule("unusualAIAccessPatterns",
                                                 event_pattern=event_pattern)

# Step 3: Configure an SNS topic to send alerts
sns_topic = aws.sns.Topic("aiModelAccessAlerts")

# Step 4: Set a CloudWatch event target to trigger the SNS topic
event_target = aws.cloudwatch.EventTarget("sendSNSNotification",
                                          rule=cloudwatch_event_rule.name,
                                          arn=sns_topic.arn)

# Output the SNS topic ARN that will receive the alerts
pulumi.export('sns_topic_arn', sns_topic.arn)
```

This program does the following:

- It initializes the GuardDuty service which will analyze and process the logs to detect anomalies and threats.
- Optionally, if you maintain a list of trusted IP addresses that you want to exclude from monitoring, you could define an `IPSet` that contains these IPs.
- It sets up a CloudWatch Event Rule based on GuardDuty findings. The event rule filters for specific types of GuardDuty findings related to AI model access patterns, such as unusual API calls to services related to AI model development and deployment.
- It creates an SNS topic that can be used to send notifications when the CloudWatch Event Rule triggers. The SNS topic can be subscribed to by email addresses, SMS, or other types of notifications such as Lambda functions to take automated actions.
- Finally, it associates the CloudWatch Event Rule with the SNS topic such that when the event pattern is matched (indicating a possible threat finding by GuardDuty), a notification is sent to the SNS topic.

To use this Pulumi program, you will need to replace the placeholder values such as `your-trusted-ip-list-bucket/trusted-ip-set.txt` with actual values that pertain to your environment. This includes setting up an S3 bucket with your text file containing trusted IP addresses if you're using an `IPSet`.

Please also make sure your Pulumi, AWS CLI, and AWS Pulumi provider are configured correctly before running this program.