CloudTrail
Last updated
Last updated
Provides governance, compliance and audit for your AWS account.
CloudTrail is enabled by default.
It can give an history of events / API calls made within your AWS account by,
Console
SDK
CLI
AWS Services
Can put logs from CloudTrail into CloudWatch Logs or S3.
A Trail can be applied to All Regions (default) or single Region.
If events more than 90 days are needed then they can be send to CloudWatch logs or S3 bucket.
It consists of all events that are performed on resources in AWS account.
By default, trails are configured to log management events.
Can separate Read Events from Write Events.
By default, data events are not logged because of high volume operations.
Examples are as follows,
AWS S3 Object level activity is one such example and can separate Read and Write Events.
AWS Lambda function execution activity is another example.
Enable CloudTrail Insights to detect unusual activity in to your account.
Inaccurate resource provisioning
Hitting service limits
Bursts of AWS IAM actions
CloudTrail Insight analyses normal management events for baseline.
Then continuously analyses writes events to detect unusual activities/patterns.
These anamolies can be viewed in CloudTrail Console and can also be sent to S3 or EventBridge can be used to generate events.
Events are stored for 90 days in CloudTrail.
To keep events beyond this 90 period, log them to S3 and use Atena (Serverless service to query S3 data) for analysis.
