Building a Real-Time Serverless SIEM with AWS Native Services

This review examines a serverless security information and event management (SIEM) pipeline, detailing its AWS architecture, real-time detection logic, and the trade-offs of a build-your-own approach.

The Answer Up Front

For engineering teams seeking a deep understanding of cloud security event processing or those aiming to minimize vendor lock-in, this serverless SIEM blueprint offers a compelling, cost-effective alternative to commercial solutions. It's particularly well-suited for organizations with strong AWS expertise and a desire for granular control over their security posture. Teams that require out-of-the-box compliance reporting, extensive threat intelligence feeds, or prefer a fully managed security product should skip this DIY approach. The bottom line: this project provides a robust, customizable foundation for real-time cloud security detection, leveraging native AWS services to process and alert on critical events.

Methodology

This v0 review draws on the founder's published claims and architectural details at https://dev.to/antonio-1313/building-a-cloud-siem-from-scratch-with-aws-lambda-and-eventbridge-59id, accessed on 2026-05-31. The review covers the proposed architecture, specific AWS service integrations, event patterns, and the detection logic outlined in the blog post and its associated GitHub repository (https://github.com/antonio-1313/aws-siem-detection-pipeline). What is not covered in this initial assessment includes independent performance benchmarks, long-term operational costs at scale, false positive rates under production load, or the efficacy of the detection rules against real-world attack simulations. Update cadence: re-tested when claims diverge from observed behavior or when significant architectural changes are introduced in the public repository.

What It Does

This project outlines a real-time, serverless security detection pipeline built entirely with AWS native services. The core idea is to process CloudTrail events to identify and alert on suspicious activities, offering a custom-built alternative to managed SIEM solutions.

Core Architecture

The pipeline uses CloudTrail as the audit log source, capturing control plane activity across an AWS account. These events are then routed through EventBridge, which acts as a real-time event bus. EventBridge rules filter for specific API calls, forwarding only relevant events to AWS Lambda functions. Lambda executes the custom detection logic, evaluating events against predefined security criteria. Findings are persisted in DynamoDB for state management and historical context, and alerts are delivered via Amazon SNS. QuickSight is proposed for visualization, though not detailed in the provided source.

Detection Scope

The project focuses on four key categories of cloud risk: authentication abuse, privilege escalation, destructive infrastructure actions, and data exposure risk. These categories encompass critical security events such as brute force login attempts, root account usage, IAM policy attachments, unexpected role changes, EC2 terminations, S3 bucket deletions, and public bucket policy modifications.

Event Filtering with EventBridge

A crucial component of the architecture is the EventBridge rule, which acts as the initial intake filter. This mechanism prevents the Lambda functions from being overwhelmed by the high volume of benign CloudTrail events. The rule is configured to watch specific AWS sources (e.g., aws.signin, aws.iam, aws.ec2, aws.s3) and a curated list of twelve event names, such as ConsoleLogin, CreateAccessKey, and AttachUserPolicy. This targeted filtering reduces noise and focuses processing on events with higher security relevance.

What's Interesting / What's Not

What makes this project interesting is its explicit, hands-on demonstration of building a cloud-native SIEM from foundational services. The founder, Antonio, provides a clear architectural blueprint and open-source code, making it an excellent learning resource for understanding the mechanics of security event processing. The detailed mapping of detection needs to specific AWS services (e.g., CloudTrail for logs, EventBridge for routing, Lambda for logic) is pragmatic and offers a transparent view into each component's role. The emphasis on real-time processing and filtering at the EventBridge layer addresses a core challenge in cloud security: separating signal from noise in high-volume audit logs. This approach offers significant customization potential, allowing teams to tailor detection logic precisely to their environment and threat model, avoiding the black-box nature of some managed solutions.

However, the project's scope, while valuable for learning, also highlights its limitations as a production-ready SIEM. The blog post does not delve into the operational overhead of maintaining such a bespoke system, including managing Lambda code updates, DynamoDB schema evolution, or the complexity of tuning detection rules to minimize false positives across a dynamic cloud environment. There's no comparative analysis against established managed SIEMs like GuardDuty, Security Hub, or commercial offerings in terms of feature parity, cost at scale, or compliance reporting capabilities. The project also doesn't address the security of the SIEM pipeline itself, which is a critical consideration for any security infrastructure.

Pricing

This solution leverages standard AWS services, so pricing is based on the consumption of CloudTrail, EventBridge, Lambda, DynamoDB, SNS, and QuickSight. There are no fixed tiers or subscription costs for the SIEM itself. Costs will scale with the volume of CloudTrail events processed, the number of Lambda invocations, and the data stored in DynamoDB. AWS Free Tier limits apply for eligible services. Pricing snapshot: May 2026.

Verdict

This serverless SIEM blueprint is a highly valuable resource for builders and security engineers who want to understand the inner workings of cloud security detection. It provides a solid architectural foundation and practical code for implementing real-time threat detection using native AWS services. For organizations with the in-house expertise and a strategic preference for building custom, highly controlled security infrastructure, this project serves as an excellent starting point. It offers a clear path to avoiding vendor lock-in and potentially reducing costs compared to commercial SIEMs. However, teams prioritizing ease of deployment, comprehensive out-of-the-box features, or minimal operational burden should consider managed security services instead. The trade-off is between deep customization and control versus reduced operational complexity.

What We'd Test Next

Our next steps would involve deploying this pipeline into a controlled, high-volume AWS environment to conduct independent performance benchmarks. We would measure end-to-end latency from event ingestion to alert delivery under varying CloudTrail event loads. A critical area for testing would be the false positive rate of the provided detection logic against a baseline of normal operational activity, followed by tuning the Lambda functions to optimize for precision and recall. We would also perform a detailed cost analysis across different event volumes to understand the economic scalability of this architecture. Finally, we would explore integration points with common incident response platforms and evaluate the security posture of the SIEM pipeline components themselves, including IAM roles and access controls.

The investor read

The trend towards 'build vs. buy' in cloud security continues, with this project exemplifying the former. As cloud environments become more complex, many organizations, especially those with strong engineering cultures, are opting for bespoke, cloud-native security solutions over traditional, often monolithic, SIEMs. This signals a growing market for highly customizable, API-driven security components and expert consulting services that can help tailor these solutions. While the project itself is a DIY blueprint, its existence highlights the demand for flexible security tooling that integrates seamlessly with existing cloud infrastructure. A productized version of this concept, perhaps as a Terraform module or a managed template, could capture a segment of the market that values control and cost-efficiency but lacks the resources for a full from-scratch build. This niche could be investable if it offers robust, well-maintained modules with strong community support or a clear path to enterprise-grade features and compliance.