Vrymdor™Protect your AWS account
Vrymdor watches sensitive activity in your AWS account through CloudTrail and EventBridge: root sign ins, failed console sign ins, logging being turned off, new access keys, policy and bucket permission changes, security group openings and key deletions.
Vrymdor never gets access to your account. Your account pushes matching events to Vrymdor through an EventBridge API destination that you create and control. There is no cross-account role, no access key, and nothing for Vrymdor to read. Delete the stack and the flow stops.
Before you start
- CloudTrail must be on for management events (a trail in the account or organization). EventBridge receives "AWS API Call via CloudTrail" events only while a trail is logging them.
- Deploy in us-east-1 first: IAM and console sign in events for global services arrive there. Add the same stack in any other region you use (StackSets can do all regions at once).
Set it up with CloudFormation (about five minutes)
- Download the template: vrymdor-eventbridge.yaml.
- In the AWS console, open CloudFormation, then Create stack, then With new resources, and upload the template.
- Parameters:
- AwarenessToken: your AWARENESS_TOKEN. It is stored by EventBridge in AWS Secrets Manager, in your
account, and sent only as a header to Vrymdor.
- VrymdorEndpoint: leave the default,
https://api.vrymdor.com/v1/ingest/aws. - Acknowledge that the stack creates an IAM role (EventBridge uses it to call the API destination; it can do nothing else) and create the stack.
To check it: run something harmless that is tracked, such as creating and then deleting an IAM user with no permissions. Within a minute it appears in your Vrymdor dashboard under Cloud and identity events.
What the stack creates
| Resource | Purpose |
|---|---|
AWS::Events::Connection |
Holds your token (API key header X-Awareness-Token) in Secrets Manager |
AWS::Events::ApiDestination |
The Vrymdor endpoint, rate limited to 10 calls a second |
AWS::IAM::Role |
Lets EventBridge invoke that one API destination, nothing else |
AWS::Events::Rule |
Matches only the security relevant event names listed in the template |
Vrymdor stores the event name, the calling identity's ARN, the target resource name, the region and account, and a one-line summary. It does not store request or response bodies.
Rotating the token
Update the stack and enter the new token for AwarenessToken. Until you do, events are refused (403) and EventBridge retries for up to 24 hours.