AWS CloudTrail

What it is

AWS CloudTrail records APIAPI (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entryClose activity in your AWS account: who did what, when, from where, and with what result. Every action taken through the AWS Management Console, AWS CLI, SDKsSDK (Software development kit)A set of libraries for a programming language that wraps a service's API and handles details such as signing requests and retrying. AWS SDKs exist for Python (Boto3), JavaScript, Java, Go, and other languages.Glossary entryClose, and AWS services is an API call, and CloudTrail captures it as an event. Use it for auditing, security investigations, compliance, and troubleshooting.

Choose CloudTrail when a question asks who deleted a resource, who changed a security groupSecurity groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entryClose, which IAM user made a call, or how to keep an audit trail of account activity. For performance metrics and application logs, use Amazon CloudWatch. For a resource's configuration history and compliance, use AWS Config.

Event history and trails

• Event history is on by default. It is a viewable, searchable, downloadable, and immutable record of the past 90 days of management events in each RegionAWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entryClose, at no charge.
• To keep events longer than 90 days, or to capture more than management events, create a trail. A trail delivers log files to an S3 bucket, and optionally to CloudWatch Logs and Amazon EventBridge.
  • A multi-Region trail records events in all enabled Regions and delivers them to one S3 bucket.
  • An organization trail, created in the AWS Organizations management account (or by a delegated administrator), logs events for every account in the organization.
• The first copy of management events delivered to S3 by a trail is free; you pay for S3 storage.
• For long-term retention of logs that are rarely read, add an S3 Lifecycle rule that moves older log files to S3 Glacier Flexible Retrieval or Glacier Deep Archive, and expires them when the retention period ends.

Types of events

Event type	What it records	Logged by default?
Management events	Control-plane operations on resources, such as creating an instance, changing a security group, or signing in	Yes
Data events	Data-plane operations on or in a resource, such as S3 GetObject and PutObject, or Lambda function invocations	No: turn them on; extra charges apply
Insights events	Unusual activity in API call rates and error rates, found by analyzing your management and data events	No: turn them on; extra charges apply

Protecting the logs

• Log file integrity validation creates signed digest files (SHA-256 hashing, SHA-256 with RSA signing), so you can prove logs weren't modified, deleted, or forged after delivery.
• Encryption: log files and digest files in S3 are always encrypted: with SSESSE (Server-side encryption)Encryption that a service applies when it stores your data and removes when you read it back. Amazon S3 encrypts every new object with SSE-S3 by default; SSE-KMS uses keys in AWS KMS instead.Glossary entryClose-S3 unless you choose SSE-KMS with your own KMS key, which gives you more control over who can read them.
• Protect the S3 bucket with a strict bucket policy, MFAMFA (Multi-factor authentication)Signing in with two or more different kinds of proof, such as a password plus a code from a phone app or a security key. AWS recommends MFA for the root user and for every human user.Glossary entryClose delete or S3 Object Lock, and ideally store logs in a separate logging account.

Analyzing events

• Send events to CloudWatch Logs to search them and create metric filters and alarms, for example on root account sign-ins or changes to security groups.
• Send events to EventBridge to react automatically to specific API calls.
• Query logs in S3 with Amazon Athena.
• CloudTrail Lake runs SQLSQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entryClose queries on events in managed event data stores. CloudTrail Lake is no longer open to new customers from May 31, 2026; existing customers can keep using it.

Security, resilience, performance, and cost

Security

• Treat CloudTrail logs as security evidence: restrict who can stop logging or delete trails (for example with SCPsSCP (Service control policy)An AWS Organizations policy that sets the maximum permissions for IAM users and roles in member accounts. It grants nothing by itself, and it does not apply to the management account.Glossary entryClose in AWS Organizations), validate integrity, and encrypt with KMS.

Resilience

• Use a multi-Region organization trail so that activity in every Region and account is captured, even in Regions you don't normally use.

Cost

• Event history is free. One copy of management events per trail is free.
• Data events, Insights events, additional copies of management events, and CloudTrail Lake are charged. You also pay for S3 storage and any CloudWatch Logs ingestion.

Monitoring

• Alarm on sensitive API activity through CloudWatch Logs metric filters, or with EventBridge rules.

CloudTrail, CloudWatch, or Config?

Question asks for	Choose
Who made an API call, and when	AWS CloudTrail
Track object-level S3 access or Lambda invocations	CloudTrail data events
Detect unusual API activity	CloudTrail Insights
Performance metrics, alarms, and application logs	Amazon CloudWatch
Configuration history of a resource and compliance with rules	AWS Config
Threat detection using CloudTrail, VPC Flow Logs, and DNSDNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entryClose logs	Amazon GuardDuty

Reverse mindmap: when the question points here

• Yes, when the question says
  • Who deleted or changed a resource→ leads to CloudTrail
  • Audit API calls for compliance→ leads to CloudTrail
  • Record sign-in and IAM activity→ leads to CloudTrail management events
• Set it up
  • Keep more than 90 days of events→ leads to Trail to S3
  • Keep logs for years at the lowest cost→ leads to S3 Lifecycle rule to Glacier Deep Archive
  • Capture activity in all Regions→ leads to Multi-Region trail
  • Capture all accounts in the organization→ leads to Organization trail
  • Log S3 object reads and writes→ leads to Data events
  • Spot unusual API call rates→ leads to Insights events
• Protect and use it
  • Prove logs were not tampered with→ leads to Log file integrity validation
  • Encrypt logs with our own key→ leads to SSE-KMS
  • Alarm on root sign-in→ leads to CloudWatch Logs metric filter
  • React to an API call automatically→ leads to EventBridge rule
  • Query old logs in S3→ leads to Athena
• No, when the question says
  • CPU or latency metrics→ leads to CloudWatch
  • Was this resource compliant last month→ leads to Config

Key takeaways

• CloudTrail records API activity: who did what, when, and from where.
• Event history keeps 90 days of management events for free; a trail stores events in S3 for as long as you want.
• Management events are logged by default; data events and Insights events must be turned on and cost extra.
• Use multi-Region and organization trails, log file integrity validation, and SSE-KMS.
• Send events to CloudWatch Logs for alarms and to EventBridge for automation; query S3 logs with Athena.
• CloudTrail Lake is closed to new customers from May 31, 2026.

Sources

• AWS CloudTrail User Guide: What is AWS CloudTrail?
• AWS CloudTrail User Guide: CloudTrail concepts
• AWS CloudTrail User Guide: Working with CloudTrail event history
• AWS CloudTrail User Guide: Working with CloudTrail trails
• AWS CloudTrail User Guide: Creating a trail for an organization
• AWS CloudTrail User Guide: Logging management events
• AWS CloudTrail User Guide: Logging data events
• AWS CloudTrail User Guide: Working with CloudTrail Insights
• AWS CloudTrail User Guide: Validating CloudTrail log file integrity
• AWS CloudTrail User Guide: Encrypting CloudTrail log files with AWS KMS keys
• AWS CloudTrail User Guide: Sending events to CloudWatch Logs
• Amazon S3 User Guide: Managing the lifecycle of objects
• AWS CloudTrail User Guide: Working with AWS CloudTrail Lake
• AWS CloudTrail User Guide: CloudTrail Lake availability change
• Amazon Athena User Guide: Query AWS CloudTrail logs
• AWS CloudTrail pricing