AWS CloudTrail
Records API calls and account activity across AWS — the audit log of who did what, when, and from where.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Logs API activity: every console click, CLI command, and SDK call becomes an event with identity, time, source IP, and parameters
- 02Management events (control plane: create/modify/delete resources) are on by default; data events (S3 object reads, Lambda invokes) are opt-in and high-volume
- 03Event history gives 90 days of management events free in the console — no setup; a trail delivers events to S3 for retention beyond 90 days
- 04One trail can cover all Regions and, via Organizations, all accounts (organization trail)
- 05Not real-time — events are delivered on a delay (typically within ~15 minutes), so it's for audit and investigation, not live alerting
Exam triggers
Phrases and scenarios that point here.
- "Who deleted / modified / accessed this resource?" → CloudTrail, always
- "Audit", "compliance", "track user activity", "record API calls" → CloudTrail
- Retain activity logs beyond 90 days → create a trail to S3
- Detect unusual API activity (spike in calls or errors) → CloudTrail Insights
- Prove logs weren't tampered with → log file integrity validation
Not this service
- Metrics, application logs, alarms → CloudWatch
- Resource configuration history and compliance rules ("what did this resource look like?") → AWS Config
- Threat detection that analyzes the logs for you → GuardDuty
Use cases
- 01Post-incident forensics: a production security group was opened to 0.0.0.0/0 overnight — CloudTrail shows which IAM principal made the call, from what IP, at what time
- 02Compliance retention: shipping an organization trail to a locked-down S3 bucket in a dedicated audit account, satisfying the auditor's 7-year requirement
- 03Catching leaked credentials: Insights flags an abnormal burst of RunInstances calls from an access key that normally only reads S3
- 04Attribution during cost spikes: matching a surprise NAT Gateway or EC2 bill to the exact API calls (and person) that created the resources
How it's charged
- 0190-day event history in the console is free, and the first copy of management events delivered by a trail is free
- 02Additional copies of management events are charged per 100,000 events delivered — duplicate trails logging the same events is the classic accidental charge
- 03Data events are always paid, from the first event — enabling S3 object-level or Lambda logging on busy resources is the billing surprise, since volume dwarfs management events
- 04Insights is charged per events analyzed, not per anomaly found
- 05CloudTrail Lake is a separate paid product (ingestion + retention pricing); S3 storage and Athena queries on trail logs are billed as normal S3/Athena usage downstream
