1Incident Response
During a security breach, CloudTrail is your primary forensic tool. By querying CloudTrail logs using Amazon Athena, security teams can trace exactly how an attacker moved laterally through the AWS environment.
2Step-by-Step Breakdown
What is CloudTrail?. A service that enables governance, compliance, and operational/risk auditing of your AWS account. It records all API calls made in AWS.
API Driven. Every action in the AWS Console, CLI, or SDK translates into an API call. CloudTrail logs every single one of them.
The Trail Record. A CloudTrail log entry tells you: WHO made the call (IAM user), WHEN they made it (timestamp), WHAT they did (action), and WHERE they did it from (IP address).
Management vs Data Events. Management events (control plane) like creating a VPC are logged by default. Data events (data plane) like reading an object from S3 are high-volume and must be explicitly enabled.
Knowledge Check. Which AWS service would you check to find out which IAM user deleted a critical production database yesterday?
- →CloudWatch
- →CloudTrail
Log Storage. CloudTrail retains logs for 90 days for free in the Event History. For long-term compliance, you must configure a 'Trail' to deliver logs to an Amazon S3 bucket.
Log Integrity. For security audits, CloudTrail Log File Validation uses digital signatures to prove that a log file was not modified or deleted after CloudTrail delivered it to S3.
CloudTrail Insights. An AI feature that automatically analyzes your logs and generates alerts when it detects unusual API activity in your account.
Global Services. Most CloudTrail logs are regional, but global services like IAM and Route 53 log their events to the us-east-1 region trail.
Summary. CloudWatch is for performance. CloudTrail is for auditing.
