AWS CloudTrail
The logbook of an AWS account: who did what, when, and from where.
Everything that happens in AWS, whether someone clicks in the console, a script runs a command or a service acts on its own, is an API call. CloudTrail records those calls. Each event says who made it (which user or role), what they did (DeleteBucket, RunInstances), on which resource, when, from which IP address, and whether it succeeded.
That record answers the questions that come up after something goes wrong. Who deleted this database? When was this firewall rule opened to the internet? Did anyone use the leaked access key, and for what? Security teams also feed CloudTrail into alerting, so that a sensitive action, like disabling logging or creating a new admin user, sets off an alarm right away.
It is on by default: the console shows the recent history of management actions (roughly the last 90 days) at no cost. To keep events longer, or to record finer-grained activity like every file read in Amazon S3, you create a trail that delivers the logs to an S3 bucket, or you use CloudTrail Lake to store and query them with SQL. Many companies send the trails of all their accounts to one locked-down account, so an intruder cannot erase their own tracks.
Keep in mind
- Records API calls: who, what, which resource, when, from where, and the result.
- The recent history of management events is available by default.
- A trail stores events long-term in Amazon S3; CloudTrail Lake lets you query them with SQL.
- Essential for audits, incident investigation and compliance.
