Feature-level notice: AWS CloudTrail Lake stopped accepting new customers on May 31, 2026. CloudTrail trails and Event History are not affected.
What is AWS CloudTrail?
AWS CloudTrail records API calls in your AWS account and stores them as immutable audit logs. Actions in the Console, CLI, or SDK are logged: who did what, when, and from where. CloudTrail is the foundation for security analysis, compliance audits, and forensic investigations.
Key Features
- Event History with the last 90 days of management events, enabled automatically
- Trails for ongoing log delivery to Amazon S3, multi-region and across AWS Organizations
- Immutable logs with Log File Integrity Validation
- Integration with CloudWatch Logs and Amazon EventBridge
- CloudTrail Insights for detecting unusual API activity patterns
- CloudTrail Lake for SQL-based analysis via event data stores
Common Use Cases
Compliance Audits: CloudTrail provides the audit trail for frameworks such as SOC 2, ISO 27001, PCI DSS, and GDPR. Auditors can trace who accessed which resources.
Security Analysis: Detect suspicious activities like unusual API calls, access from unknown regions, or changes to IAM policies. Integration with GuardDuty and Security Hub enables automated threat detection.
Troubleshooting: Reconstruct changes to your infrastructure. Find out who modified a security group or deleted a resource.
Benefits
- Basic audit functionality automatically enabled
- Immutable logs for compliance evidence
- Centralized logs across all accounts and regions possible
- Native integration with AWS security services
- Binding SLA with at least 99.9% Monthly Uptime Percentage
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS CloudTrail: multi-account trail architecture, security analysis workflows, compliance-ready log retention, and CloudTrail Lake queries.
Typical Use Cases
Frequently Asked Questions
What does AWS CloudTrail cost?
The last 90 days of management events are viewable for free via Event History, as is delivery of one copy trail to S3 (S3 storage costs apply separately). Data events cost $0.10 per 100,000 events, and Insights events and CloudTrail Lake are billed additionally based on ingestion and query volume.
What is the difference between management and data events?
Management events log control plane activities (e.g., CreateBucket, StartInstances). Data events log data plane activities (e.g., GetObject/PutObject in S3, Invoke in Lambda) and must be explicitly enabled.
How quickly are CloudTrail logs available?
CloudTrail delivers log files on average about every 5 minutes, though no fixed delivery time is guaranteed. For near real-time analysis, CloudTrail can be combined with EventBridge or CloudWatch Logs.
Can I protect CloudTrail logs from tampering?
Yes, enable Log File Integrity Validation. CloudTrail creates a hash for each log file and a digest for each hourly period to make tampering detectable.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.