AWS CloudTrail

AWS CloudTrail

  • Provides governance, compliance and audit for an AWS account
  • CloudTrail is enabled by default
  • CloudTrail provides a history of events/API calls made within an AWS account from:
    • AWS Console
    • SDK
    • CLI
    • AWS services
  • Logs from CloudTrail can be put into CloudWatch Logs
  • If a resource is deleted in AWS, CloudTrail should contain trace of the operation
  • CloudTrail records account activity and service events from most AWS services and logs the following records:
    • The identity of the API caller
    • The time of the API call
    • The source IP address of the API caller
    • The request parameters
    • The response elements returned by the AWS service -Trails can be configured to log data events and management events:
    • Data events: These events provide insight into the resource operations performed on or within a resource. These are also known as data plane operations
    • Management events: Management events provide insight into management operations that are performed on resources in your AWS account. These are also known as control plane operations. Management events can also include non-API events that occur in the account