What is AWS CloudTrail?
AWS CloudTrail records all API calls in your AWS account and stores them as immutable audit logs. Every action in the Console, CLI, or SDK is logged: who did what, when, and from where. CloudTrail is the foundation for security analysis, compliance audits, and forensic investigations.
Key Features
- Automatic logging of all AWS API calls
- Immutable logs with integrity validation
- Multi-region and multi-account trails via Organizations
- Integration with CloudWatch Logs and EventBridge
- CloudTrail Lake for SQL-based analysis
Common Use Cases
Compliance Audits: CloudTrail provides the audit trail for SOC 2, ISO 27001, PCI DSS, and GDPR. Auditors can trace who accessed which resources.
Security Analysis: Detect suspicious activities like unusual API calls, access from unknown regions, or changes to IAM policies. Integration with GuardDuty and Security Hub for automated threat detection.
Troubleshooting: Reconstruct changes to your infrastructure. Find out who modified a security group or deleted a resource.
Benefits
- Basic audit functionality automatically enabled
- Immutable logs for compliance evidence
- Centralized logs across all accounts and regions
- Native integration with AWS security services
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS CloudTrail: multi-account trail architecture, security analysis workflows, compliance-ready log retention, and CloudTrail Lake queries.
Typical Use Cases
Frequently Asked Questions
What does AWS CloudTrail cost?
The first management events are free (90 days retention). A trail for long-term storage costs nothing, but S3 storage and optional data events cost extra ($0.10 per 100,000 events).
What is the difference between management and data events?
Management events log control plane activities (CreateBucket, StartInstances). Data events log data plane activities (GetObject, PutObject in S3, Invoke in Lambda).
How quickly are CloudTrail logs available?
Management events typically appear in CloudTrail within 15 minutes. For real-time analysis, you can integrate CloudTrail with EventBridge or CloudWatch Logs.
Can I protect CloudTrail logs from tampering?
Yes, enable Log File Integrity Validation. CloudTrail creates a hash for each log file and a digest for each hour period to detect tampering.