# AWS CloudTrail

> The logbook of an AWS account: who did what, when, and from where.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-cloudtrail/
- In Spanish: [AWS CloudTrail](https://tidbit.legios.com.ar/es/aws-cloudtrail/)

Everything that happens in AWS, whether someone clicks in the console, a script runs a command or a service acts on its own, is an API call. **CloudTrail** records those calls. Each **event** says who made it (which user or role), what they did (`DeleteBucket`, `RunInstances`), on which resource, when, from which IP address, and whether it succeeded.

That record answers the questions that come up after something goes wrong. Who deleted this database? When was this firewall rule opened to the internet? Did anyone use the leaked access key, and for what? Security teams also feed CloudTrail into alerting, so that a sensitive action, like disabling logging or creating a new admin user, sets off an alarm right away.

It is on by default: the console shows the recent history of management actions (roughly the last 90 days) at no cost. To keep events longer, or to record finer-grained activity like every file read in Amazon S3, you create a **trail** that delivers the logs to an S3 bucket, or you use CloudTrail Lake to store and query them with SQL. Many companies send the trails of all their accounts to one locked-down account, so an intruder cannot erase their own tracks.

## An analogy

The visitor log and the security cameras of a building, combined. Every door opened is written down with a name and a time, so when something goes missing you can rewind and see who was there.

## Keep in mind

- Records API calls: who, what, which resource, when, from where, and the result.
- The recent history of management events is available by default.
- A trail stores events long-term in Amazon S3; CloudTrail Lake lets you query them with SQL.
- Essential for audits, incident investigation and compliance.

## Go deeper

- [What is AWS CloudTrail? (official docs)](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)
- [AWS CloudTrail](https://aws.amazon.com/cloudtrail/)

## Related terms

- [API](https://tidbit.legios.com.ar/api/): The menu of things one program lets another program ask for.
- [IP address](https://tidbit.legios.com.ar/ip-address/): The number that identifies a device on a network, like a postal address.
- [Database](https://tidbit.legios.com.ar/database/): An organized store of data that programs can search and update safely.
- [Firewall](https://tidbit.legios.com.ar/firewall/): A gatekeeper that decides which network traffic gets in or out.
- [Internet](https://tidbit.legios.com.ar/internet/): A worldwide network of networks that lets any connected device reach any other.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [SQL](https://tidbit.legios.com.ar/sql/): The language you use to ask a database questions.