AWS CloudTrail

AWS CloudTrail is an AWS tool primarily used for logging any events that represent operations and actions done by users, AWS services, or IAM roles. These logs can be analyzed for monitoring and governing the AWS infrastructure. These events comprise any AWS service or resource actions via the AWS Management Console, AWS CLI, or AWS SDKs and APIs. This makes CloudTrail ideal for auditing, validating compliance standards, identifying security breaches, or troubleshooting any operational issues.

Note: CloudTrail Event History is automatically enabled by default when we create an AWS account without requiring us to perform any steps manually. Any activity that happens within our AWS account gets recorded as a CloudTrail event.

What are CloudTrail events?

A CloudTrail event is any action taken by an AWS user, role, resource, or service within our account. These actions are recorded as events within the logs by CloudTrail. CloudTrail events are of the following types:

• Management events: Management events represent actions performed on resources within our AWS account. For example, launching an EC2 instance (RunInstances) is considered a management event.

• Data events: Data events represent object-level actions performed within specific AWS ...