All 7 AWS CloudTrail & Auditing questions
More in AWS CloudTrail & Auditing
What is AWS CloudTrail and why is it important for security and compliance? How can you set up real time alerting based on specific CloudTrail events using CloudWatch Logs and alarms? How does CloudTrail log file integrity validation help ensure that audit logs have not been tampered with? How can an organization consolidate CloudTrail logging across multiple AWS accounts using AWS Organizations? What is the difference between CloudTrail management events and data events, and when should data events be enabled? How does CloudTrail Lake differ from traditional CloudTrail trails for running complex audit queries?
Advertisement
Back to results for “Monitoring (CloudWatch)”
AWS › AWS CloudTrail & Auditing

What is the difference between CloudTrail Event history and a CloudTrail trail?

Beginner

Answer

CloudTrail Event history provides a free, ninety day rolling view of management events directly in the console without any setup required, while creating a CloudTrail trail lets you deliver log files continuously to an S3 bucket for long term storage beyond ninety days, optionally send events to CloudWatch Logs for real time monitoring and alerting, and capture additional event types such as data events for services like S3 object level activity.
aws cloudtrail create-trail --name my-trail --s3-bucket-name my-cloudtrail-logs
Real-world example A company relying only on the default ninety day Event history realizes it cannot investigate an incident from six months ago, prompting them to set up a proper CloudTrail trail with long term S3 storage going forward.

Common follow-ups: What are management events versus data events in CloudTrail?;How do you ensure CloudTrail logs are protected from tampering?

S3 & Storage;Monitoring (CloudWatch)
All 7 AWS CloudTrail & Auditing questions