Skip to main content
AWS CloudTrail is the managed service that records API activity and user actions in your AWS account. It acts as a detailed audit trail, capturing who performed an action, what the action was, when it happened, and the request context — information that’s essential for auditing, security investigations, and compliance.
A CloudTrail-themed diagram showing users connecting to a cloud service and a boxed list of AWS resources. The box displays icons and names like Amazon EC2, RDS, EKS, Lambda, DynamoDB, S3, Elastic Load Balancing, Route 53, VPC, and SNS.
How CloudTrail records an API call:
  • Origin of the request: IAM user, role, or AWS service
  • Source IP address and request parameters
  • Target service and action (for example, ec2:TerminateInstances)
  • Timestamp of the call
  • Response and status details
Event types: management, data, and Insights
By default, the CloudTrail Event History in the console retains the most recent 90 days of management events. To keep a longer history, centralize logs across accounts, or enable analytics, create a Trail and deliver events to Amazon S3. You can additionally stream events to CloudWatch Logs or EventBridge for monitoring and automation.
Where a Trail can deliver events:
  • Amazon S3 — long-term storage and archival for audit and compliance.
  • Amazon CloudWatch Logs — create metric filters, dashboards, and alarms from log data.
  • Amazon EventBridge — near-real-time routing of events to targets like Lambda, SNS, and SQS.
Storing CloudTrail logs in S3 unlocks analytics and search workflows. Common analytic tools:
  • Amazon Athena — run SQL queries directly against CloudTrail logs on S3.
  • OpenSearch (formerly Elasticsearch) — index logs for interactive search and visualization.
A simple AWS CloudTrail architecture diagram showing CloudTrail storing logs to S3, S3 feeding an analysis box (ElasticSearch and Athena), and users running queries on the analyzed data.
Alerting, automation, and remediation CloudTrail combined with CloudWatch Logs or EventBridge enables detection and automated response patterns. Typical flows include creating metric filters or rules that detect suspicious activity and initiating notifications or remediation functions. Common automated workflows:
A simple AWS architecture diagram showing CloudTrail events going to CloudWatch, which triggers actions handled by EventBridge and SNS. Notifications from SNS/EventBridge are sent to users or a Lambda function.
Example use case
  • Detect console sign-ins from an unusual IP range with an EventBridge rule.
  • Rule triggers a Lambda function that disables compromised credentials, rotates keys, or isolates affected resources.
  • Simultaneously publish an alert to an SNS topic for human investigation.
Why CloudTrail matters CloudTrail is indispensable for auditing, forensic investigations, incident detection, troubleshooting, and compliance reporting. By delivering logs to S3 and integrating with analytics and monitoring services, you can maintain historical records, run complex queries, visualize activity, and automate incident response.
A presentation slide titled "CloudTrail" listing key benefits: it tracks and records all API activity in an AWS account, helps with auditing and forensic analysis, and stores logs in Amazon S3. It also notes uses for detecting security incidents, troubleshooting, and meeting compliance requirements.
Best practices
  • Enable a multi-region Trail and apply it across all accounts (or use AWS Organizations Trails) to ensure comprehensive, centralized logging.
  • Deliver logs to an S3 bucket with encryption enabled, restricted write permissions, and lifecycle policies for retention/archival.
  • Integrate with CloudWatch Logs or EventBridge to enable near-real-time monitoring, alerting, and automated remediation.
  • Use Amazon Athena or OpenSearch for querying and visualizing historical CloudTrail data.
  • Protect your CloudTrail configuration and S3 bucket from deletion or tampering using IAM policies, bucket policies, and organizational safeguards.
Links and references

Watch Video