ACKF logoACKF
Management and Governance

AWS CloudTrail

View on GitHub

AWS CloudTrail

AWS CloudTrail records account activity and API calls across supported AWS services and resources, delivering event records for auditing and investigation. It operates by capturing management events, optional data events, and delivering log files or near-real-time events to destinations such as Amazon S3, Amazon CloudWatch Logs, and Amazon EventBridge. It typically fits as the account-level and organization-level audit and logging service used for compliance, security analysis, and operational troubleshooting.

🗂 Resource Category

Security, Identity, and Compliance • Management and Governance

🧠 Exam Memory Hook

Think: "Account API auditing + centralized log delivery = AWS CloudTrail"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the CloudTrail service control plane and the underlying AWS infrastructure that hosts the service, and AWS manages the availability and patching of the service platform and physical infrastructure. AWS is responsible for the service runtime, APIs, and the mechanisms that deliver recorded events to configured destinations. AWS does not manage customer destinations (for example, the contents of objects in the customer's Amazon S3 buckets) beyond delivering log files according to the configured trail.

Customer responsibilities: The customer configures trails, selects whether to log management events and data events, configures destinations (for example S3 buckets, CloudWatch Logs groups, and EventBridge), manages encryption and access controls for delivered logs, configures lifecycle policies for archived logs, and monitors delivered events and alerts. The customer is responsible for applying IAM policies to control who can create or modify trails, validating and auditing trails, and integrating CloudTrail output with security, SIEM, or analytics tools.

Patching responsibilities: AWS patches and maintains the physical infrastructure and managed CloudTrail service platform and runtime. The customer is responsible for patching and maintaining any resources that generate the recorded events (for example EC2 guest operating systems, containers, or application runtimes) and for patching any compute or runtime used to process CloudTrail logs (for example Lambda functions or data-processing EC2 instances). If customers deploy analytics or log-processing applications, they must patch and maintain those application components and their dependencies.

🏗 Typical Architecture

💡 Top 5 Features

  • Records management events (control-plane API activity) across supported AWS services for audit and compliance.
  • Optionally records data events for specific resources such as Amazon S3 objects and AWS Lambda function invocations.
  • Delivers log files to Amazon S3 for durable archival and to Amazon CloudWatch Logs for log-based monitoring and analysis.
  • Publishes events to Amazon EventBridge for near-real-time routing, detection, and automation workflows.
  • Supports organization trails to centralize logging across AWS Organizations and multiple accounts when configured.

✅ Top 5 Use Cases

  • Provide an immutable audit trail of AWS API activity for regulatory compliance and forensic investigation by delivering logs to Amazon S3.
  • Enable near-real-time security detections by sending events to Amazon EventBridge and integrating with detection or automation tools.
  • Capture data events for S3 and Lambda to monitor access to sensitive objects and serverless function invocations for security and access controls.
  • Integrate with Amazon CloudWatch Logs and analytics pipelines to troubleshoot operational issues and correlate API activity with system metrics.
  • Centralize cross-account logging using an organization trail to simplify retention, analysis, and incident response across multiple accounts.

🏗 Architecture Placement

CloudTrail functions as an account- and optionally organization-level logging service that ingests API calls and AWS service events emitted by AWS services, AWS SDKs, the AWS Management Console, and AWS CLI. It delivers recorded events to destinations such as Amazon S3 for archival, Amazon CloudWatch Logs for monitoring and search, and Amazon EventBridge for near-real-time routing and automation. Trails can be configured as single-region, multi-region, or organization-level depending on visibility requirements. It is used downstream by SIEMs, analytics pipelines, and security automation.

🎯 Commonly Used With

- Amazon S3
- AWS Identity and Access Management
- Amazon CloudWatch
- Amazon EventBridge
- AWS Security Hub

🌍 5 Real-World Examples

  • A bank configures multi-region trails and central S3 log buckets to retain API activity for auditors and to support security investigations.
  • A healthcare provider enables S3 data events in CloudTrail to log access to buckets that store protected health information to support access reviews.
  • A retail DevOps team routes CloudTrail events to EventBridge and Lambda to trigger automated workflows when high-risk IAM changes occur.
  • A telecommunications operator integrates CloudTrail with CloudWatch Logs and analytics to correlate API errors with deployment and scaling events for troubleshooting.
  • A government IT unit uses organization trails to collect logs from multiple accounts into a central archive for compliance and forensic capability.

🎓 AWS Exam Clues

  • CloudTrail records API activity and management events; it is chosen when an audit trail of AWS control-plane actions is required.
  • Enable data events explicitly when you need object-level S3 access logs or Lambda invocation records because they are not recorded by default.
  • Use an organization trail to centralize logs across multiple accounts under AWS Organizations for simplified management and retention.
  • Route CloudTrail events to EventBridge for near-real-time detection and automation rather than relying solely on periodic S3 log file delivery.
  • CloudTrail captures API activity; it does not capture network-level traffic (use VPC Flow Logs for network traffic visibility).

📝 Quick Revision

CloudTrail records AWS API calls and service events and delivers them to S3, CloudWatch Logs, or EventBridge for audit, security, and troubleshooting. Use multi-region and organization trails, enable data events when object-level activity is required, and secure and lifecycle-manage the destination logs.

🏷 Keywords

trail • management events • data events • log file delivery • multi-region trail • organization trail • CloudWatch Logs integration • EventBridge integration • S3 log archive • log file validation • CloudTrail Insights • audit trail