Auditing AWS Accounts with CloudTrail
Track API activity and investigate security incidents using CloudTrail.
Every API call made against your AWS account — through the console, CLI, SDKs, or by another AWS service on your behalf — is, by design, recorded by CloudTrail. It's the definitive answer to "who did what, when, and from where" on AWS.
Management vs data events
- Management events — control-plane operations: creating a Lambda function, modifying a security group, changing an IAM policy. Logged by default, at no extra cost, for the last 90 days via Event history in the console.
- Data events — data-plane operations: reading/writing an S3 object, invoking a Lambda function. Much higher volume, so not logged by default — you opt in per resource type, and they incur a cost proportional to volume, since every S3 GetObject on a busy bucket would otherwise generate enormous log volume.
Setting up a trail for long-term retention
Event history only covers 90 days and isn't ideal for systematic querying. A trail delivers events continuously to an S3 bucket (and optionally CloudWatch Logs) for indefinite retention and analysis:
bash
1
2
3
4
5
aws cloudtrail create-trail \
--name org-audit-trail \
--s3-bucket-name my-cloudtrail-logs \
--is-multi-region-trail \
--enable-log-file-validation--enable-log-file-validation adds cryptographic integrity checking, letting you later prove log files haven't been tampered with — important for any audit or forensic use case where log integrity itself might be questioned.An organization trail
In an AWS Organizations setup, a single organization trail created from the management account captures events from every member account automatically, delivered to one centralized S3 bucket — essential for actually being able to investigate an incident that might have touched multiple accounts, rather than needing to check each account's logs separately (and trust that logging wasn't disabled in the compromised one).
Querying CloudTrail logs at scale
Once trail logs are in S3, register them with Athena (AWS provides a sample table DDL for CloudTrail's JSON structure) to run SQL queries across months of history:
sql
1
2
3
4
SELECT eventtime, eventname, useridentity.arn, sourceipaddress
FROM cloudtrail_logs
WHERE eventname = 'DeleteBucket'
AND eventtime > '2026-09-01'Investigating an incident
Start from the resource or timeframe you know is affected, and work outward: find the specific event that changed the resource, identify the calling identity (
useridentity), then search for all activity by that identity around the same time window — a compromised credential rarely does exactly one thing, and the surrounding activity usually reveals the fuller scope of what happened.Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article