Master AWS Certified Solutions Architect Associate SAA-C03 Exam/

...

/

AWS CloudTrail

AWS CloudTrail

Get a detailed introduction to the AWS CloudTrail service and how it works.

We'll cover the following...

Another crucial component of monitoring and auditing our cloud infrastructure is tracking and logging every action on the cloud resource. AWS CloudTrail is one such service that logs all activity and API calls within our AWS cloud. Hence, we can use CloudTrail for explicit purposes of auditing, validating compliance standards, identifying security breaches, or troubleshooting any operational issues.

Introduction to CloudTrail

AWS CloudTrail is an AWS tool primarily used for logging any events that represent operations and actions done by users, AWS services, or IAM roles. These logs can be analyzed for monitoring and governing the AWS infrastructure. These events comprise any actions of an AWS service or resource via the AWS Management Console, AWS CLI, or AWS SDKs and APIs.

CloudTrail Event History is automatically enabled by default when we create an AWS account without requiring us to perform any steps manually. Any activity that happens within our AWS account gets recorded as a CloudTrail event.

Press + to interact

Here are some use cases of CloudTrail:

  • Audit the AWS Infrastructure: We can use CloudTrail to help audit our AWS infrastructure to affirm that it’s compliant with any industry and security regulations.

  • Maintain AWS Infrastructure security: We can use CloudTrail to improve the infrastructure security to log all user activity and have an automated service like EventBridge to set up workflows to identify any unusual activity within the collected logs and trigger the appropriate actions.

  • Operational statistics: By logging all operations that take place on AWS with CloudTrail we can extrapolate some insightful statistics from the logs. These statistics can be used to speed up debugging operational issues, investigate operational anomalies, or provide explanations to any operational queries. Some CloudTrail services, like CloudTrail Lake, also offer dashboards that display any visual trends.

Note: Please note that CloudTrail does not support the following AWS services and events:

  • AWS Import/Export service

  • Policy-specific events in Amazon VPC endpoints

  • AWS services that are still in preview

  • AWS services that are not made available for general use

  • AWS services that don’t support public APIs

CloudTrail events

A CloudTrail event is any action taken by an AWS user, role, resource, or service within our account. These ...