All 7 AWS CloudTrail & Auditing questions
More in AWS CloudTrail & Auditing
What is the difference between CloudTrail Event history and a CloudTrail trail? How can you set up real time alerting based on specific CloudTrail events using CloudWatch Logs and alarms? How does CloudTrail log file integrity validation help ensure that audit logs have not been tampered with? How can an organization consolidate CloudTrail logging across multiple AWS accounts using AWS Organizations? What is the difference between CloudTrail management events and data events, and when should data events be enabled? How does CloudTrail Lake differ from traditional CloudTrail trails for running complex audit queries?
Advertisement
AWS › AWS CloudTrail & Auditing

What is AWS CloudTrail and why is it important for security and compliance?

Beginner

Answer

AWS CloudTrail is a service that automatically records every API call and action taken within your AWS account, including who made the request, what action was performed, when it happened, and from where, providing a detailed audit trail that is essential for security investigations, compliance reporting, and understanding exactly what changes were made across your entire AWS environment over time.
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteBucket
Real-world example A security team investigating an unexpected S3 bucket deletion uses CloudTrail logs to identify exactly which IAM user or role performed the deletion, along with the precise timestamp and source IP address of the request.

Common follow-ups: Is CloudTrail enabled by default for every AWS account?;How long does CloudTrail retain event history by default?

IAM;AWS Config
All 7 AWS CloudTrail & Auditing questions