AWS CloudTrail & Auditing
7 questions found
What is AWS CloudTrail and why is it important for security and compliance?
Beginner
AWS CloudTrail is a service that automatically records every API call and action taken within your AWS account, including who made the request, what action was performed, when it happened, and from where, providing a detailed audit trail that is essential for security investigations, compliance reporting, and understanding exactly what changes were made across your entire AWS environment over time.
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket
Real-world example
A security team investigating an unexpected S3 bucket deletion uses CloudTrail logs to identify exactly which IAM user or role performed the deletion, along with the precise timestamp and source IP address of the request.
Common follow-ups: Is CloudTrail enabled by default for every AWS account?;How long does CloudTrail retain event history by default?
IAM;AWS Config
What is the difference between CloudTrail Event history and a CloudTrail trail?
Beginner
CloudTrail Event history provides a free, ninety day rolling view of management events directly in the console without any setup required, while creating a CloudTrail trail lets you deliver log files continuously to an S3 bucket for long term storage beyond ninety days, optionally send events to CloudWatch Logs for real time monitoring and alerting, and capture additional event types such as data events for services like S3 object level activity.
aws cloudtrail create-trail --name my-trail --s3-bucket-name my-cloudtrail-logs
Real-world example
A company relying only on the default ninety day Event history realizes it cannot investigate an incident from six months ago, prompting them to set up a proper CloudTrail trail with long term S3 storage going forward.
Common follow-ups: What are management events versus data events in CloudTrail?;How do you ensure CloudTrail logs are protected from tampering?
S3 & Storage;Monitoring (CloudWatch)
How can you set up real time alerting based on specific CloudTrail events using CloudWatch Logs and alarms?
Intermediate
By configuring a CloudTrail trail to deliver logs to CloudWatch Logs, you can then create metric filters that scan incoming log entries for specific patterns, such as a root user login or a security group being modified, and trigger a CloudWatch alarm the moment that pattern is detected, which can then notify your security team through SNS almost immediately rather than requiring someone to manually review logs after the fact.
aws logs put-metric-filter --log-group-name CloudTrail/Logs --filter-name RootLoginFilter --filter-pattern '{ $.userIdentity.type = "Root" }' --metric-transformations metricName=RootLoginCount,metricNamespace=Security,metricValue=1
Real-world example
A security team sets up a CloudWatch alarm based on a CloudTrail metric filter that immediately notifies them through SNS whenever the root account is used to log in, since root account usage is rare and often indicates something worth investigating.
Common follow-ups: What other suspicious activities are commonly monitored using CloudTrail metric filters?;How quickly does an alert typically fire after a matching CloudTrail event occurs?
Monitoring (CloudWatch);Amazon SNS (Simple Notification Service)
How does CloudTrail log file integrity validation help ensure that audit logs have not been tampered with?
Intermediate
CloudTrail log file integrity validation uses digital signatures and hash chaining to create a way to cryptographically verify that a delivered log file has not been altered or deleted since CloudTrail originally wrote it, giving auditors and security teams strong confidence that the audit trail they are reviewing accurately reflects what actually happened in the account, which is especially important for meeting strict compliance requirements.
aws cloudtrail validate-logs --trail-arn arn:aws:cloudtrail:us-east-1:123456789012:trail/my-trail --start-time 2026-09-01T00:00:00Z
Real-world example
An auditor reviewing security logs for a regulated financial company uses CloudTrail's log file validation feature to cryptographically confirm that none of the audit logs being reviewed have been altered since they were originally recorded.
Common follow-ups: How does the hash chaining mechanism actually work behind the scenes?;What should you do if log validation reveals a log file has been tampered with?
AWS KMS & Data Encryption;AWS Security Hub & GuardDuty
How can an organization consolidate CloudTrail logging across multiple AWS accounts using AWS Organizations?
Intermediate
AWS Organizations supports creating an organization trail, which automatically applies a single CloudTrail configuration across every member account in the organization, delivering all of their logs into a centralized S3 bucket typically owned by a dedicated security or logging account, ensuring consistent audit coverage across the entire organization without needing to manually configure CloudTrail separately in every individual account.
aws cloudtrail create-trail --name org-trail --s3-bucket-name central-logging-bucket --is-organization-trail
Real-world example
A company with fifty separate AWS accounts under a single AWS Organization sets up one organization trail that automatically captures and centralizes CloudTrail logs from every account into a dedicated logging account, simplifying auditing significantly.
Common follow-ups: Can individual member accounts disable or modify an organization trail?;What IAM permissions are needed to set up an organization trail?
AWS Organizations & Multi Account Strategy;S3 & Storage
What is the difference between CloudTrail management events and data events, and when should data events be enabled?
Advanced
Management events capture control plane operations, such as creating or deleting resources, and are captured by default, while data events capture more granular, high volume actions like individual S3 object level reads and writes or Lambda function invocations, which are not enabled by default due to their potentially large volume and additional cost, and should be enabled specifically when you need detailed visibility into data access patterns, such as detecting unauthorized reads of sensitive objects in a specific S3 bucket.
aws cloudtrail put-event-selectors --trail-name my-trail --event-selectors '[{"ReadWriteType":"All","DataResources":[{"Type":"AWS::S3::Object","Values":["arn:aws:s3:::sensitive-bucket/"]}]}]'
Real-world example
A company handling sensitive customer documents enables S3 data events specifically for the bucket storing those documents, allowing them to track every individual file access, while leaving data events disabled for less sensitive, high traffic buckets to control cost.
Common follow-ups: How does enabling data events affect CloudTrail costs at scale?;What other services besides S3 and Lambda support data event logging?
S3 & Storage;AWS Cost Management & Billing
How does CloudTrail Lake differ from traditional CloudTrail trails for running complex audit queries?
Advanced
CloudTrail Lake is a managed data lake specifically for CloudTrail events that lets you run SQL based queries directly against your audit logs without needing to first set up a separate system like Athena and manage the underlying S3 data structure yourself, making it easier to perform complex, ad hoc investigations and generate compliance reports directly from a purpose built interface designed specifically for security and audit analysis.
aws cloudtrail start-query --query-statement "SELECT eventName, COUNT(*) FROM my_event_data_store GROUP BY eventName ORDER BY COUNT(*) DESC"
Real-world example
A compliance team uses CloudTrail Lake to quickly run an ad hoc SQL query identifying every instance where a specific sensitive IAM policy was modified over the past year, without needing to set up a custom Athena table structure themselves.
Common follow-ups: How does CloudTrail Lake pricing compare to querying CloudTrail logs manually through Athena?;How long can event data stores in CloudTrail Lake retain data?
Amazon Athena;AWS Config