Cloudtrial

AWS CloudTrail – Monitoring AWS Activity

AWS CloudTrail is an AWS service that records and tracks activities performed in an AWS account. It helps us understand who did what, when, and from where.

What is AWS CloudTrail?

CloudTrail keeps a history of actions performed through the AWS Management Console, AWS CLI, SDKs, and AWS APIs.

For example, if someone creates an EC2 instance, deletes an S3 bucket, or changes an IAM permission, CloudTrail can record that activity.

Simple Example

Imagine your AWS account has several users.

If an S3 bucket is accidentally deleted, you may want to know:

- Who deleted it?
- When was it deleted?
- What action was performed?
- From where was the request made?

CloudTrail helps answer these questions.

How CloudTrail Works

A simple flow is:

User → AWS Service → API Request → CloudTrail → Event Log

CloudTrail records important information about the event, such as the user, time, action, and AWS service involved.

What Does CloudTrail Record?

CloudTrail can record events such as:

- Creating an EC2 instance
- Starting or stopping an EC2 instance
- Creating or deleting an S3 bucket
- Changing IAM permissions
- Creating AWS resources
- Modifying security settings
- API calls made to AWS services

Types of CloudTrail Events

1. Management Events

These record management operations performed on AWS resources.

Example:

Create EC2 instance → CloudTrail records the API activity

2. Data Events

These provide more detailed activity for certain resources.

For example, they can record actions involving objects in an S3 bucket.

3. Insights Events

CloudTrail Insights can help identify unusual API activity that may indicate unexpected behavior.

Why is CloudTrail Important?

Security

CloudTrail helps investigate suspicious activity.

Auditing

Organizations can track changes made to AWS resources.

Troubleshooting

It can help find out what happened when a resource unexpectedly changes.

Compliance

Activity logs can support security and compliance requirements.

CloudTrail and CloudWatch

CloudTrail and CloudWatch are different services:

CloudTrail → Records AWS activity and API events

CloudWatch → Monitors applications, resources, metrics, and logs

They can also work together for monitoring and alerting.

Real-World Example

Suppose an IAM user accidentally changes an S3 bucket policy.

CloudTrail can show the API activity associated with that change. A security team can then investigate the event and determine which identity made the change.

Conclusion

AWS CloudTrail is an important service for security, auditing, monitoring, and troubleshooting in AWS. It provides visibility into activities happening inside an AWS account.

For cloud learners, remember:

CloudTrail = “Who did what in my AWS account?”