AWS CloudTrail mindmap

AWS CloudTrail

Records actions taken by users, roles and AWS services as events, for governance, compliance and operational and risk auditing

• Event types
  • Management events: Control plane operations, such as creating a bucket or an IAM role
  • Data events: Resource operations, such as S3 object reads and writes or Lambda invocations; extra cost
  • Network activity events: AWS API calls made through your VPC endpoints, including calls denied at the endpoint
  • Insights events: Unusual API call rates or error rates
• Event history: The last 90 days of management events in a Region, without creating a trail
• Trails: Ongoing delivery of events
  • Multi-Region trails: Recommended; capture events from every Region
  • Organization trail: One trail for every account in the organization
  • Delivery to Amazon S3: Log files delivered about every 5 minutes
  • CloudWatch Logs: Metric filters and alarms on API activity
  • Amazon EventBridge: React to API calls in near real time
• Security of the logs
  • Log file integrity validation: Digest files with SHA-256 hashing and signing prove that logs were not changed
  • Encryption: SSE-S3 by default; SSE-KMS with your own key
  • Protect the bucket: Restrictive bucket policy, MFA delete and S3 Object Lock
• CloudTrail Lake: Managed data lake to aggregate, store immutably and query events
  • Event data stores: Collect CloudTrail events, Insights events, Config items, Audit Manager evidence and events from outside AWS
  • SQL queries: Run SQL over events; generate queries from plain English prompts
  • Retention: Up to about 10 years with one-year extendable pricing, up to about 7 years with seven-year pricing
  • Dashboards: Managed, custom and Highlights views of activity
  • Integrations: Bring in activity from non-AWS sources
• Common uses
  • Security investigation: Who did what, when and from where
  • Compliance auditing: Evidence for auditors
  • Operational troubleshooting: Trace the change that broke something