AWS CloudTrail
- What it is
- Records API activity across your AWS account: who called what, when, from which IP, with which credentials.
- The governance, compliance, and forensic audit log of AWS.
- Key traits
- Enabled by default; the last 90 days of management events are viewable free in Event History.
- For longer retention, create a trail delivering events to Amazon S3 (and optionally Amazon CloudWatch Logs).
- Organization trails capture every account in AWS Organizations into one bucket.
- Log file validation and S3 Object Lock protect the log from tampering.
- Event types
- Management events — control plane (create an instance, change a policy). Logged by default.
- Data events — high-volume data plane (S3 object reads, Lambda invocations). Off by default, charged.
- Insights events — flags unusual API call rate patterns.
- The classic exam pair
- “Who deleted the S3 bucket?” → CloudTrail. “Why is CPU at 100%?” → CloudWatch.